CVE-2025-25291

ruby-saml, the widely used Ruby library for SAML single sign-on, incorrectly verifies XML digital signatures in all versions prior to 1.12.4 and prior to 1.18.0 because it relies on two XML parsers (ReXML and Nokogiri) that can build entirely different document structures from the same XML input. This parser differential enables a Signature Wrapping attack: an attacker can inject crafted, partially unsigned content into a legitimately signed SAML response so the library validates the signature on one part of the document while consuming attacker-controlled data from another. A successful attack results in a complete authentication bypass, letting the attacker sign in as any victim user without credentials. Any Ruby application using ruby-saml for SAML SSO is affected, directly or via downstream integrations such as OmniAuth SAML, OneLogin's Ruby tooling, GitLab CE/EE and NetApp StorageGRID SSO. Exploitation in the wild is not confirmed, but public proof-of-concept research from GitHub and PortSwigger exists and EPSS places the flaw in the top percentiles of near-term exploit likelihood (~20% in 30 days).

What to do: Upgrade ruby-saml to 1.18.0, or to 1.12.4 if pinned to the 1.12 branch, and redeploy affected applications; downstream users should apply patched releases of OmniAuth SAML, GitLab CE/EE and NetApp StorageGRID as vendors publish them. Until patched, review SAML SSO sign-in logs for unexpected or anomalous authentications and check for duplicate/reused assertion IDs in SAML responses, since any SAML-protected account is potentially bypassable without valid credentials.