CVE-2025-25291
criticalpriority · attend · 46EPSS 0.210 · 98 %ileDEEUNLRUUSEPSS · scored 2026-10-26
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (69)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0087Kwetsbaarheden verholpen in GitLabNL2025-03-14csaf · ncsc_nlNL
GitLab heeft kwetsbaarheden verholpen in GitLab EE/CE versies van 11.5 tot 17.9.2.
- WID-SEC-W-2025-0549GitLab: Mehrere SchwachstellenDeutsch2025-03-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Informationen preiszugeben, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2025-0561Ruby SAML: Mehrere SchwachstellenDeutsch2025-03-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby SAML ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.
- GHSA-4vc4-m8qh-g8jmRuby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)2025-03-12ghsa · osvUS
### Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. ### Impact This issue may lead to authentication bypass.
- BIT-gitlab-2025-25291ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)2025-04-14vendor · osvUS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (31)
External citations — patches, advisories, analysis.
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-releasedcnnvd
- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentialscnnvd
- https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jmcnnvd
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xvcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan