CVE-2026-45720: Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token

SAML.getSession (internal/pkg/auth/interceptor/saml.go) checks the Used flag on a SAMLAssertion resource and then marks it used in two separate state operations. Because the check and the update are not atomic, concurrent requests carrying the same saml-session token can both observe Used == false, both pass validation, and both return a successful authentication context. An attacker who obtains a valid saml-session token can exploit this window to authenticate as the token’s owner multiple times, defeating the one-time-use guarantee.