CVE-2025-25292 Critical · 9.3 EPSS 65.1%

Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

SAML-Toolkits · ruby-saml

Summary

A parser differential in ruby-saml's handling of XML namespaces lets ReXML and Nokogiri build different document structures from the same SAML input, enabling signature validation to check one element while authentication reads another. An unauthenticated attacker with network access can exploit this without user interaction or prior authentication to perform a Signature Wrapping attack and bypass authentication.

Official description · CVE.org

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.

Breakdown

26.4 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 12 Mar 2025. No public exploit code or confirmed exploitation is recorded.

See the family tree

A fix was bypassed or incomplete once over 15 months. The latest fix listed for ruby-saml is 1.18.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2024-45409The Ruby SAML library vulnerable to a SAML authentication bypass…10 Sep 2024
relatedHigh
Why these are linked:
- Fixed one release later1.12.3 → 1.12.4 (ruby-saml)
- Same code patched: xml_security.rb (machine-matched)Functions: validate_signaturecommit 1ec5392 commit 4865d03 commit e76c5b3 commit e9c1cdb
CVE-2025-25291ruby-saml vulnerable to SAML authentication bypass due to…12 Mar 2025
same family
This CVECVE-2025-25292Ruby SAML vulnerable to SAML authentication bypass due to…12 Mar 2025
relatedMedium
Why these are linked:
- Same code patched: saml_message.rb (machine-matched)Functions: decode_raw_samlcommit e76c5b3 commit e9c1cdb commit acac9e9 commit e2da4c6
CVE-2025-25293ruby-saml vulnerable to Remote Denial of Service (DoS) with…12 Mar 2025
relatedMedium
Why these are linked:
- Same code patched: saml_message.rb (machine-matched)Functions: decode_raw_samlcommit acac9e9 commit e2da4c6 commit e9c1cdb
CVE-2025-66567ruby-saml has a SAML authentication bypass due to namespace…9 Dec 2025
relatedMedium
Why these are linked:
- Same code patched: saml_message.rb (machine-matched)Functions: decode_raw_samlcommit e9c1cdb commit acac9e9
CVE-2025-66568ruby-saml Libxml2 Canonicalization errors can bypass…9 Dec 2025

Fixes in ruby-samlRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.7.0CVE-2017-1142817 Apr 2019
1.17.0CVE-2024-4540910 Sep 2024
1.18.0CVE-2025-2529112 Mar 2025
1.18.0CVE-2025-2529212 Mar 2025
1.18.0CVE-2025-2529312 Mar 2025
1.18.0CVE-2025-665679 Dec 2025
1.18.0CVE-2025-665689 Dec 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: ruby-saml.

RubyGemsruby-samlGHSA-754f-8gm6-c4r2

Upgrade to 1.18.0 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2024-45409).

Gemfilegem "ruby-saml", ">= 1.18.0"

The first fix for CVE-2025-25292.

Affected versions, by release line

If you run	Upgrade to
1.13.0 up to 1.18.0	1.18.0
All versions before 1.12.4	1.12.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

13 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2025-6414

No public exploit code found.

, 30 Oct 2026

65.1%Top 0.75%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.25%).

4.0

9.3Critical · 9.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9925 19.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 9.3 6.5/7

End-of-life productsupported or unknown 0.0

Total26.4

Record

Published: 12 Mar 2025
Modified: 3 Nov 2025
: CWE-347 Improper Verification of Cryptographic SignatureCWE-436 Interpretation Conflict
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in ruby-samlRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

x_refsource_CONFIRM 1

x_refsource_MISC 9

Other 3

techniques