CVE-2025-25292: critical vulnerability in SAML-Toolkits ruby-saml
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Ruby SAML has a flaw where different XML parsers handle namespaces differently, allowing attackers to forge valid authentication tokens and bypass login protections. This is a critical vulnerability that can give unauthorized access to protected systems.
The vulnerability stems from parser differential behavior between ReXML and Nokogiri in namespace handling, enabling Signature Wrapping attacks (CWE-347) where attackers craft malicious SAML responses that validate against one parser but execute differently in another. No special privileges required; the attack vector is network-based and affects the SAML authentication flow prior to versions 1.12.4 and 1.18.0.
In the same product, most dangerous first.