CVE-2025-27509: Fleet has SAML authentication vulnerability due to improper SAML response validation

In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to:

• Forge authentication assertions, potentially impersonating legitimate users.
• If Just-In-Time (JIT) provisioning is enabled, the attacker could provision a new administrative user account.
• If MDM enrollment is enabled, certain endpoints could be used to create new accounts tied to forged assertions.

This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration.