CVE-2025-25292

ruby-saml versions prior to 1.12.4 and 1.18.0 (CVE-2025-25292) are vulnerable to an authentication bypass caused by a parser differential: the ReXML and Nokogiri XML parsers used in the SAML validation path can produce entirely different document structures from the same XML input (CWE-347, CWE-436). An attacker who can submit a crafted SAML response, for example through an account on a connected identity provider, can craft a response whose signature validates under one parser while the assertion is interpreted differently under the other, executing a Signature Wrapping attack. Successful exploitation allows an unauthenticated attacker to sign in as any user of the service provider, bypassing SAML SSO and enabling account takeover. Any Ruby application authenticating via ruby-saml directly or through dependencies such as omniauth-saml is affected, along with products that bundle the library such as NetApp StorageGRID and SSO platforms like GitLab that depend on it. The flaw is not yet on the CISA KEV list, but public PoCs and detailed write-ups from GitHub and PortSwigger are available, and a high EPSS score (65.1%, 99th percentile) indicates an elevated likelihood of exploitation within 30 days.

What to do: Upgrade ruby-saml to 1.12.4 if pinned to the 1.12.x line or, preferably, to 1.18.0, and rebuild/update dependent gems such as omniauth-saml; apply vendor updates for NetApp StorageGRID as they become available. Operators of SAML SSO endpoints should prioritize internet-facing identity flows, audit recent sign-ins for anomalies, and verify patched versions are actually loaded at runtime (e.g., via 'gem list' or the dependency lockfile).