MDM SSO callback returns "missing profile" error for Android enrollment #45024

Fleet versions 4.84.3

• Discovered: 4.84.3
• Reproduced: 4.84.3

Web browser and operating system: Android

💥  Actual behavior

After configuring End User Authentication SSO correctly, and attempting EUA SSO enrollment for an Android device, the SSO callback fails with a generic “Something went wrong” error. The root cause logged server-side is “missing profile: missing profile”.

{
    "ts": "2026-05-08T09:30:29Z",
    "level": "error",
    "component": "http",
    "method": "POST",
    "uri": "/api/v1/fleet/mdm/sso/callback",
    "took": 15301407,
    "err": "missing profile: missing profile"
}

🛠️ Expected behavior

Once authenticated, the enrolment should complete without errors.

🧑‍💻  Steps to reproduce

These steps:

• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Configure Android MDM only
2. Configure SSO for the fleet
3. Configure EUA for the fleet
4. Attempt to enrol an Android device

🕯️ More info (optional)

• Apple MDM is setup up on a similar instance, and SSO is working fine on that one. This instance does not have Apple MDM set up though, since it is only for Android.

That is a bug in the MDM SSO callback handler, that does not correctly check/verify paths outside, and enters this code section:

fleet/ee/server/service/mdm.go

Lines 1140 to 1150 in d0324a9

	depProf, err := svc.getAutomaticEnrollmentProfile(ctx)
	if err != nil {
	return "", "", "", "", sso.SSORequestData{}, ctxerr.Wrap(ctx, err, "listing profiles")
	}
	if depProf == nil {
	return "", "", "", "", sso.SSORequestData{}, ctxerr.Wrap(ctx, errors.New("missing profile"), "missing profile")
	}
	depProfToken = depProf.Token
	}
	// using the idp token as a reference just because that's the

Logging the initiator, it comes back as ota_enroll