Skip to content

SAML authentication bypass due to namespace handling (parser differential)

Critical
pitbulk published GHSA-754f-8gm6-c4r2 Mar 12, 2025

Package

bundler omniauth-saml (RubyGems)

Affected versions

<=2.2.2, <= 1.10.5

Patched versions

2.2.3, 1.10.6
bundler ruby-saml (RubyGems)
<=1.12.3 || >=1.13.0 < 1.18.0
1.18.0, 1.12.4

Description

Summary

An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

Impact

This issue may lead to authentication bypass.

Severity

Critical

CVE ID

CVE-2025-25292

Weaknesses

Credits