The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
Priority HIGH 82CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.10684 95th percentileScored 2026-11-07
Fix Fixed ruby-saml (SAML-Toolkits): 1.12.3, 1.17.0ruby-saml (RubyGems): 1.12.3, 1.17.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAML-Toolkits | ruby-saml | before 1.12.3; 1.13.0 to before 1.17.0 | 1.12.3, 1.17.0 | Patch available | CNA |
| — | ruby-saml (RubyGems) | before 1.12.3 | 1.12.3 | Patch available | GHSA-jw9c-mfg7-9rx2 |
| — | ruby-saml (RubyGems) | 1.13.0 to before 1.17.0 | 1.17.0 | Patch available | GHSA-jw9c-mfg7-9rx2 |
- ruby-saml VendorSAML-Toolkits Affected before 1.12.3; 1.13.0 to before 1.17.0 Fixed in 1.12.3, 1.17.0 Patch available CNA
- ruby-saml (RubyGems) Vendor— Affected before 1.12.3 Fixed in 1.12.3 Patch available GHSA-jw9c-mfg7-9rx2
- ruby-saml (RubyGems) Vendor— Affected 1.13.0 to before 1.17.0 Fixed in 1.17.0 Patch available GHSA-jw9c-mfg7-9rx2
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* | before 1.12.3; 1.13.0 to before 1.17.0 | Vulnerable | SAML-Toolkits |
| cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* | up to 1.10.3 | Vulnerable | OmniAuth |
| cpe:2.3:a:omniauth:omniauth_saml:2.0.0:*:*:*:*:ruby:*:* | 2.0.0 | Vulnerable | OmniAuth |
| cpe:2.3:a:omniauth:omniauth_saml:2.1.0:*:*:*:*:ruby:*:* | 2.1.0 | Vulnerable | OmniAuth |
| cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | before 16.11.10; 17.0.0 to before 17.0.8; 17.1.0 to before 17.1.8; 17.2.0 to before 17.2.7; 17.3.0 to before 17.3.3 | Vulnerable | GitLab |
- cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* Versions before 1.12.3; 1.13.0 to before 1.17.0 Vulnerable ·SAML-Toolkits
- cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* Versions up to 1.10.3 Vulnerable ·OmniAuth
- cpe:2.3:a:omniauth:omniauth_saml:2.0.0:*:*:*:*:ruby:*:* Versions 2.0.0 Vulnerable ·OmniAuth
- cpe:2.3:a:omniauth:omniauth_saml:2.1.0:*:*:*:*:ruby:*:* Versions 2.1.0 Vulnerable ·OmniAuth
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* Versions before 16.11.10; 17.0.0 to before 17.0.8; 17.1.0 to before 17.1.8; 17.2.0 to before 17.2.7; 17.3.0 to before 17.3.3 Vulnerable ·GitLab
Remediation
- Fix · CNA ruby-saml (SAML-Toolkits) Fixed in 1.12.3, 1.17.0
- Fix · GHSA-jw9c-mfg7-9rx2 ruby-saml (RubyGems) Fixed in 1.12.3 Advisory →
- Fix · GHSA-jw9c-mfg7-9rx2 ruby-saml (RubyGems) Fixed in 1.17.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45409
- 2026-10-03 Alias added: GHSA-jw9c-mfg7-9rx2
- 2026-11-03 CISA SSVC decision points changed
References
Patch 2
Advisory 3
Other 5
- https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
- https://github.com/SAML-Toolkits/ruby-saml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml
More SAML-Toolkits Ruby-saml vulnerabilities
- TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2025-18945 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2015-08083 xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and… CVSS 3.1CRITICAL 9.8
- TI-2025-40979 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation CVSS 4.0CRITICAL 9.3
- TI-2025-40978 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2017-08453 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-45409 · CVE Program
- CVE-2024-45409 · NVD
- FIRST EPSS
- GHSA-jw9c-mfg7-9rx2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences