"SAML.getSession" ("internal/pkg/auth/interceptor/saml.go") checks the "Used" flag on a "SAMLAssertion" resource and then marks it used in two separate state operations. Because the check and the update are not atomic, concurrent requests carrying the same "saml-session" token can both observe "Used == false", both pass validation, and both return a successful authentication context. An attacker who obtains a valid "saml-session" token can exploit this window to authenticate as the token's owner multiple times, defeating the one-time-use guarantee.