CVE-2025-25291: critical vulnerability in SAML-Toolkits ruby-saml
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Ruby-saml has a critical flaw where XML parsers handle SAML authentication messages differently, allowing attackers to bypass login security. An attacker can manipulate the XML structure to forge valid authentication without correct credentials.
CVE-2025-25291 exploits parser differential behavior between ReXML and Nokogiri to execute Signature Wrapping attacks against SAML assertions. The vulnerability allows an unauthenticated attacker to craft malicious XML DOCTYPE declarations that are parsed differently by the two engines, resulting in signature validation bypass and authentication circumvention in ruby-saml versions before 1.12.4 and 1.18.0.
In the same product, most dangerous first.