GitLab addressed critical auth bypass flaws in CE and EE)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-25292 +1 in the same advisory: …25291 | Authentication Bypass (Signature Wrapping) in ruby-saml via XML Parser Differential ruby-saml versions prior to 1.12.4 and 1.18.0 (CVE-2025-25292) are vulnerable to an authentication bypass caused by a parser differential: the ReXML and Nokogiri XML parsers used in the SAML validation path can produce entirely different document structures from the same XML input (CWE-347, CWE-436). An attacker who can submit a crafted SAML response, for example through an account on a connected identity provider, can craft a response whose signature validates under one parser while the assertion is interpreted differently under the other, executing a Signature Wrapping attack. Successful exploitation allows an unauthenticated attacker to sign in as any user of the service provider, bypassing SAML SSO and enabling account takeover. Any Ruby application authenticating via ruby-saml directly or through dependencies such as omniauth-saml is affected, along with products that bundle the library such as NetApp StorageGRID and SSO platforms like GitLab that depend on it. The flaw is not yet on the CISA KEV list, but public PoCs and detailed write-ups from GitHub and PortSwigger are available, and a high EPSS score (65.1%, 99th percentile) indicates an elevated likelihood of exploitation within 30 days. Do: Upgrade ruby-saml to 1.12.4 if pinned to the 1.12.x line or, preferably, to 1.18.0, and rebuild/update dependent gems such as omniauth-saml; apply vendor updates for NetApp StorageGRID as they become available. Operators of SAML SSO endpoints should prioritize internet-facing identity flows, audit recent sign-ins for anomalies, and verify patched versions are actually loaded at runtime (e.g., via 'gem list' or the dependency lockfile). | 9.3 | 65% | PoC ×2 |
| massplausibly hundreds of thousands to millions of application deployments (ruby-saml/omniauth-saml are foundational Ruby SSO libraries with very large cumulative… | |
| CVE-2025-27407 | graphql-ruby is a Ruby implementation of GraphQL. graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue. NVD description · AI analysis pending | 9.0 | 3% | — | — |
Full article514 words · extracted from securityaffairs.com · click to collapse
GitLab addressed two critical authentication bypass vulnerabilities in Community Edition (CE) and Enterprise Edition (EE).
GitLab released security updates to address critical vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). The company addressed nine vulnerabilities, including the two critical ruby-saml authentication bypass issues respectively tracked as CVE-2025-25291 and CVE-2025-25292.
GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2 addressed the issue. GitLab.com is already patched.
“GitLab has remediated two privately disclosed security issues (CVE-2025-25291, CVE-2025-25292) identified in the ruby-saml library which GitLab uses when SAML SSO authentication is enabled at the instance or group level.” reads the advisory published by the company. “On GitLab CE/EE instances using SAML authentication, under certain circumstances, an attacker with access to a valid signed SAML document from the IdP could authenticate as another valid user within the environment’s SAML IdP.”
Attackers with a valid signed SAML document can impersonate users within the same SAML IdP, risking data breaches and privilege escalation.
“Attackers who are in possession of a single valid signature that was created with the key used to validate SAML responses or assertions of the targeted organization can use it to construct SAML assertions themselves and are in turn able to log in as any user.” reads a technical analysis of the two critical flaws. In other words, it could be used for an account takeover attack.”
GitLab Dedicated customers receive automatic updates, while self-managed users must apply updates manually.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.” continues the advisory. “When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.”
GitHub doesn’t use ruby-saml for authentication but found its vulnerabilities in GitLab and alerted their security team to mitigate potential attacks.
“GitHub doesn’t currently use ruby-saml for authentication, but began evaluating the use of the library with the intention of using an open source library for SAML authentication once more. This library is, however, used in other popular projects and products.” continues the analysis. “We discovered an exploitable instance of this vulnerability in GitLab, and have notified their security team so they can take necessary actions to protect their users against potential attacks.”
Below is the full list of flaws addressed by the company:
Customers unable to update GitLab CE/EE should enable two-factor authentication, disable SAML two-factor bypass, and require admin approval for new users.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/175370/security/gitlab-addressed-critical-flaws-in-ce-and-ee.html