CVE-2025-25292

CRITICAL

ruby-saml <1.12.4,1.18.0 - Auth Bypass

Title source: llm
STIX 2.1

Description

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.

References (13)

Core 13
Core References
Exploit, Third Party Advisory x_refsource_misc
https://portswigger.net/research/saml-roulette-the-hacker-always-wins

Scores

CVSS v3 9.8
EPSS 0.6379
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-436 CWE-347
Status published
Products (4)
netapp/storagegrid
omniauth/omniauth_saml < 1.10.6
onelogin/ruby-saml < 1.12.4
rubygems/ruby-saml 1.13.0 - 1.18.0RubyGems
Published Mar 12, 2025
Tracked Since Feb 18, 2026