Vulnerabilities

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

ruby-saml versions prior to 1.12.4 and 1.18.0 (CVE-2025-25292) are vulnerable to an authentication bypass caused by a parser differential: the ReXML and Nokogiri XML parsers used in the SAML validation path can produce entirely different document structures from the same XML input (CWE-347, CWE-436). An attacker who can submit a crafted SAML response, for example through an account on a connected identity provider, can craft a response whose signature validates under one parser while the assertion is interpreted differently under the other, executing a Signature Wrapping attack. Successful exploitation allows an unauthenticated attacker to sign in as any user of the service provider, bypassing SAML SSO and enabling account takeover. Any Ruby application authenticating via ruby-saml directly or through dependencies such as omniauth-saml is affected, along with products that bundle the library such as NetApp StorageGRID and SSO platforms like GitLab that depend on it. The flaw is not yet on the CISA KEV list, but public PoCs and detailed write-ups from GitHub and PortSwigger are available, and a high EPSS score (65.1%, 99th percentile) indicates an elevated likelihood of exploitation within 30 days.

Do: Upgrade ruby-saml to 1.12.4 if pinned to the 1.12.x line or, preferably, to 1.18.0, and rebuild/update dependent gems such as omniauth-saml; apply vendor updates for NetApp StorageGRID as they become available. Operators of SAML SSO endpoints should prioritize internet-facing identity flows, audit recent sign-ins for anomalies, and verify patched versions are actually loaded at runtime (e.g., via 'gem list' or the dependency lockfile).

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.