Ruby Saml
Monthly
Authentication bypass in ruby-saml (OneLogin SAML toolkit) versions up to and including 1.12.4 lets remote, unauthenticated attackers defeat SAML signature verification by exploiting a libxml2 canonicalization failure that yields an empty string, enabling a Signature Wrapping attack against identity providers and service providers built on the library. Any application that uses the vulnerable gem to validate signed SAML responses/assertions is affected, and no privileges or user interaction are required per the assessed vector (PR:N/UI:N), so an internet-exposed SAML login endpoint is reachable by unauthenticated attackers. The fix is vendor-released in 1.18.0; at time of analysis there is no CISA KEV listing and no public exploit code has been identified, and EPSS is low at ~0.24% (13th percentile), suggesting exploitation has not yet been observed at scale despite the high technical severity.
SAML authentication bypass in ruby-saml versions up to and including 1.12.4 allows a remote, unauthenticated attacker to impersonate arbitrary users in applications that use the library as their SAML service-provider client. The root cause is an incomplete fix for CVE-2025-25292: because ReXML and Nokogiri generate different document structures from identical XML input, an attacker who holds any legitimately signed SAML assertion can perform a Signature Wrapping attack, having the signature verified over one element while a different, attacker-chosen assertion is consumed as the authenticated identity. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but exploitation requires only network reachability and a single valid signed assertion (CVSS 4.0 base 9.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); version 1.18.0 contains the vendor fix.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.8%.
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Authentication bypass in ruby-saml (OneLogin SAML toolkit) versions up to and including 1.12.4 lets remote, unauthenticated attackers defeat SAML signature verification by exploiting a libxml2 canonicalization failure that yields an empty string, enabling a Signature Wrapping attack against identity providers and service providers built on the library. Any application that uses the vulnerable gem to validate signed SAML responses/assertions is affected, and no privileges or user interaction are required per the assessed vector (PR:N/UI:N), so an internet-exposed SAML login endpoint is reachable by unauthenticated attackers. The fix is vendor-released in 1.18.0; at time of analysis there is no CISA KEV listing and no public exploit code has been identified, and EPSS is low at ~0.24% (13th percentile), suggesting exploitation has not yet been observed at scale despite the high technical severity.
SAML authentication bypass in ruby-saml versions up to and including 1.12.4 allows a remote, unauthenticated attacker to impersonate arbitrary users in applications that use the library as their SAML service-provider client. The root cause is an incomplete fix for CVE-2025-25292: because ReXML and Nokogiri generate different document structures from identical XML input, an attacker who holds any legitimately signed SAML assertion can perform a Signature Wrapping attack, having the signature verified over one element while a different, attacker-chosen assertion is consumed as the authenticated identity. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but exploitation requires only network reachability and a single valid signed assertion (CVSS 4.0 base 9.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); version 1.18.0 contains the vendor fix.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.8%.
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.