TI-2025-40979 CVE-2025-66568 · GHSA-x4h9-gwv3-r4m4
ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation
Priority MEDIUM 48
The ruby-saml library implements the client side of an SAML authorization.
Vulnerabilities
9 records
TI-2025-40978 CVE-2025-66567 · GHSA-9v8j-x534-2fx3
ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Priority MEDIUM 48
The ruby-saml library is for implementing the client side of a SAML authorization.
TI-2025-18946 CVE-2025-25292 · GHSA-754f-8gm6-c4r2
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
Priority HIGH 84
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.
TI-2025-18945 CVE-2025-25291 · GHSA-4vc4-m8qh-g8jm
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Priority HIGH 81
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.
TI-2025-18947 CVE-2025-25293 · GHSA-92rq-c8cf-prrq
ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
Priority MEDIUM 43
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.
TI-2024-30458 CVE-2024-45409 · GHSA-jw9c-mfg7-9rx2
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
Priority HIGH 82
The Ruby SAML library is for implementing the client side of a SAML authorization.
TI-2015-08083 CVE-2015-20108 · GHSA-r364-2pj4-pf7f
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and…
Priority MEDIUM 52
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
TI-2017-08453 CVE-2017-11428 · GHSA-x2fr-v8wf-8wwv
Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
Priority MEDIUM 47
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryp…
TI-2016-04948 CVE-2016-5697 · GHSA-36p7-xjw8-h6f2
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
Priority LOW 35
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.