CVE-2025-25291

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.

• CWE-347
• CWE-436

• https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-releasedPatch
• https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentialsExploit, Third Party Advisory
• https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9Patch
• https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97Patch
• https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4Release Notes
• https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0Release Notes
• https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jmVendor Advisory
• https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xvVendor Advisory
• https://portswigger.net/research/saml-roulette-the-hacker-always-winsExploit, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-samlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
• https://news.ycombinator.com/item?id=43374519Issue Tracking
• https://security.netapp.com/advisory/ntap-20250314-0010/Third Party Advisory

Published

Mar 12, 2025

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25286Crayfish is a collection of Islandora 8 microservices, one o…9.8
• CVE-2025-25287Lakeus is a simple skin made for MediaWiki. Starting in vers…4.7
• CVE-2025-25288@octokit/plugin-paginate-rest is the Octokit plugin to pagin…5.3
• CVE-2025-25289@octokit/request-error is an error class for Octokit request…5.3
• CVE-2025-2529Applications using affected versions of Ehcache 3.x can expe…3.7
• CVE-2025-25290@octokit/request sends parameterized requests to GitHub’s AP…5.3
• CVE-2025-25292ruby-saml provides security assertion markup language (SAML)…9.8
• CVE-2025-25293ruby-saml provides security assertion markup language (SAML)…7.5
• CVE-2025-25294Envoy Gateway is an open source project for managing Envoy P…5.3
• CVE-2025-25295Label Studio is an open source data labeling tool. A path tr…8.7
• CVE-2025-25296Label Studio is an open source data labeling tool. Prior to …6.1
• CVE-2025-25297Label Studio is an open source data labeling tool. Prior to …7.7