CVE-2024-45409 Public exploit Critical · 10.0 EPSS 10.7%

The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

SAML-Toolkits · ruby-saml

Summary

The Ruby SAML library (ruby-saml from SAML-Toolkits) does not properly verify the signature of SAML Responses in affected versions. The flaw lies in the library's client-side SAML authorization handling. An unauthenticated attacker with access to any document signed by the identity provider can forge a SAML Response or Assertion with arbitrary contents and log in as any user in the vulnerable system, requiring no authentication, user interaction, or special configuration beyond use of the affected library.

Official description · CVE.org

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Breakdown

67.2 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 35 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 27 days after disclosure.

Disclosed10 Sep 2024day 0
Public exploit codePoC-in-GitHub7 Oct 2024+27 days
First seen exploitedVulnCheck KEV evidence15 Oct 2024+35 days

See the family tree

A fix was bypassed or incomplete once over 15 months. The latest fix listed for ruby-saml is 1.18.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2024-45409The Ruby SAML library vulnerable to a SAML authentication bypass…10 Sep 2024
relatedHigh
Why these are linked:
- Fixed one release later1.12.3 → 1.12.4 (ruby-saml)
- Same code patched: xml_security.rb (machine-matched)Functions: validate_signaturecommit 1ec5392 commit 4865d03 commit e76c5b3 commit e9c1cdb
CVE-2025-25291ruby-saml vulnerable to SAML authentication bypass due to…12 Mar 2025
same family
CVE-2025-25292Ruby SAML vulnerable to SAML authentication bypass due to…12 Mar 2025
relatedMedium
Why these are linked:
- Same code patched: saml_message.rb (machine-matched)Functions: decode_raw_samlcommit e76c5b3 commit e9c1cdb commit acac9e9 commit e2da4c6
CVE-2025-25293ruby-saml vulnerable to Remote Denial of Service (DoS) with…12 Mar 2025
relatedMedium
Why these are linked:
- Same code patched: saml_message.rb (machine-matched)Functions: decode_raw_samlcommit acac9e9 commit e2da4c6 commit e9c1cdb
CVE-2025-66567ruby-saml has a SAML authentication bypass due to namespace…9 Dec 2025
relatedMedium
Why these are linked:
- Same code patched: saml_message.rb (machine-matched)Functions: decode_raw_samlcommit e9c1cdb commit acac9e9
CVE-2025-66568ruby-saml Libxml2 Canonicalization errors can bypass…9 Dec 2025

Fixes in ruby-samlRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.0.0CVE-2015-2010827 May 2023
1.3.0CVE-2016-569723 Jan 2017
1.7.0CVE-2017-1142817 Apr 2019
1.17.0CVE-2024-4540910 Sep 2024
1.18.0CVE-2025-2529112 Mar 2025
1.18.0CVE-2025-2529212 Mar 2025
1.18.0CVE-2025-2529312 Mar 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: ruby-saml.

RubyGemsruby-samlGHSA-jw9c-mfg7-9rx2

Upgrade to 1.18.0 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2025-25292).

Gemfilegem "ruby-saml", ">= 1.18.0"

First fixed in 1.17.0 for CVE-2024-45409.

Affected versions, by release line

If you run	Upgrade to
1.13.0 up to 1.17.0	1.18.0first fix for this CVE: 1.17.0
All versions before 1.12.3	1.12.4first fix for this CVE: 1.12.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 2 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Midwest Malware26 Aug 2026
Cellbrite Domain Irregularities25 Feb 2026

References

8 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2024-2828

Public exploitAdvisories link exploit code.

, 30 Oct 2026

10.7%Top 4.2%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 95.8%).

3.1

10.0Critical · 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 746 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9580 19.2/20

Threat reports0 reports 0.0/10

Public exploit code1 PoC-in-GitHub repo 5.0/5

Mentioned in OTX pulses2 pulses 1.1/3

CVSS base scorebase score 10 7.0/7

End-of-life productsupported or unknown 0.0

Total67.2

Record

Published: 10 Sep 2024
Modified: 11 Nov 2024
: CWE-347 Improper Verification of Cryptographic Signature
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in ruby-samlRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 2 community threat pulses (AlienVault OTX)

References

x_refsource_CONFIRM 1

x_refsource_MISC 3

Other 4

techniques