ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Priority HIGH 81CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.20965 97th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed ruby-saml (SAML-Toolkits): 1.12.4, 1.18.0ruby-saml (RubyGems): 1.12.4, 1.18.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAML-Toolkits | ruby-saml | before 1.12.4; 1.13.0 to before 1.18.0 | 1.12.4, 1.18.0 | Patch available | CNA |
| — | ruby-saml (RubyGems) | before 1.12.4 | 1.12.4 | Patch available | GHSA-4vc4-m8qh-g8jm |
| — | ruby-saml (RubyGems) | 1.13.0 to before 1.18.0 | 1.18.0 | Patch available | GHSA-4vc4-m8qh-g8jm |
- ruby-saml VendorSAML-Toolkits Affected before 1.12.4; 1.13.0 to before 1.18.0 Fixed in 1.12.4, 1.18.0 Patch available CNA
- ruby-saml (RubyGems) Vendor— Affected before 1.12.4 Fixed in 1.12.4 Patch available GHSA-4vc4-m8qh-g8jm
- ruby-saml (RubyGems) Vendor— Affected 1.13.0 to before 1.18.0 Fixed in 1.18.0 Patch available GHSA-4vc4-m8qh-g8jm
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* | before 1.10.6; 2.0.0 to before 2.1.3; 2.2.0 to before 2.2.3 | Vulnerable | OmniAuth |
| cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* | before 1.12.4; 1.13.0 to before 1.18.0 | Vulnerable | SAML-Toolkits |
| cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* Versions before 1.10.6; 2.0.0 to before 2.1.3; 2.2.0 to before 2.2.3 Vulnerable ·OmniAuth
- cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* Versions before 1.12.4; 1.13.0 to before 1.18.0 Vulnerable ·SAML-Toolkits
- cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA ruby-saml (SAML-Toolkits) Fixed in 1.12.4, 1.18.0
- Fix · GHSA-4vc4-m8qh-g8jm ruby-saml (RubyGems) Fixed in 1.12.4 Advisory →
- Fix · GHSA-4vc4-m8qh-g8jm ruby-saml (RubyGems) Fixed in 1.18.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25291
- 2026-10-03 Alias added: GHSA-4vc4-m8qh-g8jm
References
Exploit 2
Patch 3
Advisory 5
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
- https://securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-saml
- https://nvd.nist.gov/vuln/detail/CVE-2025-25291
- https://security.netapp.com/advisory/ntap-20250314-0010/
Other 7
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
- https://github.com/SAML-Toolkits/ruby-saml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-25291.yml
- https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
- https://news.ycombinator.com/item?id=43374519
- https://security.netapp.com/advisory/ntap-20250314-0010
More SAML-Toolkits Ruby-saml vulnerabilities
- TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2024-30458 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVSS 3.1CRITICAL 10.0
- TI-2015-08083 xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and… CVSS 3.1CRITICAL 9.8
- TI-2025-40979 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation CVSS 4.0CRITICAL 9.3
- TI-2025-40978 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2017-08453 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-25291 · CVE Program
- CVE-2025-25291 · NVD
- FIRST EPSS
- GHSA-4vc4-m8qh-g8jm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences