ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

Vulnerability

Overview

CVE-2025-25291 is an authentication bypass vulnerability in the ruby-saml library, which implements SAML single sign-on (SSO) for Ruby. The root cause is a parser differential between the ReXML and Nokogiri XML parsers used by the library. These parsers can generate entirely different document structures from the same XML input, allowing an attacker to craft a SAML response that is interpreted differently during signature validation and subsequent processing [1][4]. This discrepancy enables a Signature Wrapping attack, where the attacker can bypass signature checks while injecting malicious content.

Exploitation

To exploit this vulnerability, an attacker must possess a single valid SAML signature created with the private key used by the target organization to sign SAML responses or assertions. With this signature, the attacker can construct a SAML assertion that passes signature validation on the service provider side but contains a different assertion structure due to the parser differential. The attack does not require prior authentication; it only requires possession of a valid signature, which could be obtained from a previously captured SAML response or through other means [3].

Impact

Successful exploitation leads to authentication bypass, allowing the attacker to log in as any user of the affected application. This effectively results in a full account takeover, as the attacker can impersonate any user without needing their credentials. The impact is critical, especially in enterprise environments where SAML SSO is used for access control [3].

Mitigation

The vulnerability is fixed in ruby-saml versions 1.12.4 and 1.18.0. Users of the library should upgrade immediately. Additionally, any dependent libraries (e.g., omniauth-saml) must be updated to versions that reference a fixed ruby-saml. The maintainers have released patches, and no workarounds are available [1][3].