Certificate validation failures in Apache CloudStack's SAML authentication allow a malicious actor to forge a SAML response that is accepted by the management server. The flaw stems from an improper handling of unsigned assertions, which aligns with CWE‑347. If an attacker succeeds, they can authenticate as a valid user and gain full administrative access to the CloudStack environment, compromising confidentiality, integrity, and availability of managed resources.

Apache CloudStack versions 4.20.3.0 and 4.22.1.0 across all platforms are affected. The issue is present in the base code that processes SAML responses and does not enforce proper signature validation.

The vulnerability permits unauthorized login once the attacker can supply a forged SAML assertion. Exploitation requires the attacker to either spoof the Identity Provider’s IP address or register their own URL as a valid IdP in the management server configuration, indicating a need for network control or administrative access to the CloudStack configuration. The CVSS score is 8.1 and the EPSS score is <1%; the vulnerability is not listed in CISA KEV, but the impact of bypassing authentication warrants a cautious approach, particularly for exposure to external networks or to untrusted IdPs.