CVE-2025-25291

CRITICAL NUCLEI

ruby-saml <1.12.4,1.18.0 - Auth Bypass

Title source: llm

Description

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.

Exploits (1)

github WORKING POC
by twypsy · pythonpoc
https://github.com/twypsy/CVE-POCs/tree/main/cve-2025-25291

Nuclei Templates (1)

GitLab - SAML Authentication Bypass
CRITICALVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: http.title:"gitlab" || cpe:"cpe:2.3:a:gitlab:gitlab" || http.html:"gitlab enterprise edition" || http.html:"gitlab-ci.yml"
FOFA: body="gitlab enterprise edition" || body="gitlab-ci.yml" || title="gitlab"

References (13)

Scores

CVSS v3 9.8
EPSS 0.2084
EPSS Percentile 95.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-436 CWE-347
Status published
Products (4)
netapp/storagegrid
omniauth/omniauth_saml < 1.10.6
onelogin/ruby-saml < 1.12.4
rubygems/ruby-saml 0 - 1.12.4RubyGems
Published Mar 12, 2025
Tracked Since Feb 18, 2026