ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

Ruby-saml has a critical flaw where XML parsers handle SAML authentication messages differently, allowing attackers to bypass login security. An attacker can manipulate the XML structure to forge valid authentication without correct credentials.

CVE-2025-25291 exploits parser differential behavior between ReXML and Nokogiri to execute Signature Wrapping attacks against SAML assertions. The vulnerability allows an unauthenticated attacker to craft malicious XML DOCTYPE declarations that are parsed differently by the two engines, resulting in signature validation bypass and authentication circumvention in ruby-saml versions before 1.12.4 and 1.18.0.