Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
Priority MEDIUM 47CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Why it matters now
EPSS 0.02464 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Ruby-SAML (OneLogin): 1.6.0ruby-saml (RubyGems): 1.7.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAML-Toolkits | Ruby-SAML | before 1.6.0 | 1.6.0 | Patch available | CNA |
| — | ruby-saml (RubyGems) | before 1.7.0 | 1.7.0 | Patch available | GHSA-x2fr-v8wf-8wwv |
- Ruby-SAML VendorSAML-Toolkits Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA
- ruby-saml (RubyGems) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-x2fr-v8wf-8wwv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* | up to 1.6.0 | Vulnerable | SAML-Toolkits |
- cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* Versions up to 1.6.0 Vulnerable ·SAML-Toolkits
Remediation
- Fix · CNA Ruby-SAML (OneLogin) Fixed in 1.6.0
- Fix · GHSA-x2fr-v8wf-8wwv ruby-saml (RubyGems) Fixed in 1.7.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-11428
- 2026-10-03 Alias added: GHSA-x2fr-v8wf-8wwv
References
More SAML-Toolkits Ruby-saml vulnerabilities
- TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2024-30458 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVSS 3.1CRITICAL 10.0
- TI-2025-18945 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2015-08083 xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and… CVSS 3.1CRITICAL 9.8
- TI-2025-40979 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation CVSS 4.0CRITICAL 9.3
- TI-2025-40978 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
Sources
- CVE-2017-11428 · CVE Program
- CVE-2017-11428 · NVD
- FIRST EPSS
- GHSA-x2fr-v8wf-8wwv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences