CVE-2025-25292
An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 65.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 65.09% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-347, CWE-436
- Affected
- omniauth/omniauth saml · onelogin/ruby-saml · netapp/storagegrid
- Source
- security-advisories@github.com
EPSS 65.1% since 2 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-releasedPatch
- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentialsExploit, Third Party Advisory
- https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9Patch
- https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97Patch
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4Release Notes
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0Release Notes
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2Vendor Advisory
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xvVendor Advisory
- https://portswigger.net/research/saml-roulette-the-hacker-always-winsExploit, Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-samlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
- https://news.ycombinator.com/item?id=43374519Issue Tracking
- https://security.netapp.com/advisory/ntap-20250314-0009/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.