Vulnerabilities

ruby-saml versions prior to 1.12.4 and 1.18.0 (CVE-2025-25292) are vulnerable to an authentication bypass caused by a parser differential: the ReXML and Nokogiri XML parsers used in the SAML validation path can produce entirely different document structures from the same XML input (CWE-347, CWE-436). An attacker who can submit a crafted SAML response, for example through an account on a connected identity provider, can craft a response whose signature validates under one parser while the assertion is interpreted differently under the other, executing a Signature Wrapping attack. Successful exploitation allows an unauthenticated attacker to sign in as any user of the service provider, bypassing SAML SSO and enabling account takeover. Any Ruby application authenticating via ruby-saml directly or through dependencies such as omniauth-saml is affected, along with products that bundle the library such as NetApp StorageGRID and SSO platforms like GitLab that depend on it. The flaw is not yet on the CISA KEV list, but public PoCs and detailed write-ups from GitHub and PortSwigger are available, and a high EPSS score (65.1%, 99th percentile) indicates an elevated likelihood of exploitation within 30 days.

Do: Upgrade ruby-saml to 1.12.4 if pinned to the 1.12.x line or, preferably, to 1.18.0, and rebuild/update dependent gems such as omniauth-saml; apply vendor updates for NetApp StorageGRID as they become available. Operators of SAML SSO endpoints should prioritize internet-facing identity flows, audit recent sign-ins for anomalies, and verify patched versions are actually loaded at runtime (e.g., via 'gem list' or the dependency lockfile).

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth's Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's choice including email addresses of other users. Applications not using info.email for identification but are instead using the uid field are not impacted in the same manner. Note, these applications may still be negatively affected if the value of info.email is being used for other purposes. Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.