Read the docs
TI-2017-08455 Aliases CVE-2017-11430GHSA-94hm-8q65-rmxm

Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

Priority MEDIUM 47CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Why it matters now

EPSS 0.02435 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OmnitAuth-SAML (OmniAuth): 1.9.0omniauth-saml (RubyGems): 1.10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OmniAuthOmnitAuth-SAMLbefore 1.9.01.9.0Patch availableCNA
—omniauth-saml (RubyGems)before 1.10.01.10.0Patch availableGHSA-94hm-8q65-rmxm
  • OmnitAuth-SAML VendorOmniAuth Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
  • omniauth-saml (RubyGems) Vendor— Affected before 1.10.0 Fixed in 1.10.0 Patch available GHSA-94hm-8q65-rmxm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:*:*:*up to 1.9.0VulnerableOmniAuth
  • cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:*:*:* Versions up to 1.9.0 Vulnerable ·OmniAuth

Remediation

  • Fix · CNA OmnitAuth-SAML (OmniAuth) Fixed in 1.9.0
  • Fix · GHSA-94hm-8q65-rmxm omniauth-saml (RubyGems) Fixed in 1.10.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11430
  2. 2026-10-03 Alias added: GHSA-94hm-8q65-rmxm

References

Exploit 1

Advisory 2

Other 2

  • TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2024-30458 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVSS 3.1CRITICAL 10.0
  • TI-2025-18945 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2025-18947 ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses CVSS 4.0HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences