SAML-Toolkits

Records13All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

SAML-Toolkits records in CISA KEV

No SAML-Toolkits vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ruby-saml 9 records HIGH Onelogin Saml Sso 1 record LOW Pythonsaml 1 record MEDIUM

Records

9 records in Ruby-saml · all components

TI-2025-18946 CVE-2025-25292 · GHSA-754f-8gm6-c4r2

Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

HIGH 84

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.65086 Published 2025-03-12 Fixed in 1.12.4, 1.18.0 CWE-347

TI-2024-30458 CVE-2024-45409 · GHSA-jw9c-mfg7-9rx2

The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

HIGH 82

The Ruby SAML library is for implementing the client side of a SAML authorization.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.10684 Published 2024-09-10 Fixed in 1.12.3, 1.17.0 CWE-347

TI-2025-18945 CVE-2025-25291 · GHSA-4vc4-m8qh-g8jm

ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

HIGH 81

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.20965 Published 2025-03-12 Fixed in 1.12.4, 1.18.0 CWE-347

TI-2015-08083 CVE-2015-20108 · GHSA-r364-2pj4-pf7f

xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and…

MEDIUM 52

xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01332 Published 2023-05-27 Fixed in 1.0.0 CWE-77

TI-2025-40979 CVE-2025-66568 · GHSA-x4h9-gwv3-r4m4

ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation

MEDIUM 48

The ruby-saml library implements the client side of an SAML authorization.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0025 Published 2025-12-09 Fixed in 1.18.0 CWE-347

TI-2025-40978 CVE-2025-66567 · GHSA-9v8j-x534-2fx3

ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

MEDIUM 48

The ruby-saml library is for implementing the client side of a SAML authorization.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00417 Published 2025-12-09 Fixed in 1.18.0 CWE-347

TI-2017-08453 CVE-2017-11428 · GHSA-x2fr-v8wf-8wwv

Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

MEDIUM 47

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryp…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02464 Published 2019-04-17 Fixed in 1.6.0, 1.7.0 CWE-287

TI-2025-18947 CVE-2025-25293 · GHSA-92rq-c8cf-prrq

ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

MEDIUM 43

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.01528 Published 2025-03-12 Fixed in 1.12.4, 1.18.0 CWE-400

TI-2016-04948 CVE-2016-5697 · GHSA-36p7-xjw8-h6f2

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

LOW 35

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01208 Published 2017-01-23 Fixed in 1.3.0 CWE-91

Open these records in search →

Critical	8
High	3
Medium	2
Low	0
No CVSS	0