Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

Vulnerability

Overview

CVE-2025-25292 is an authentication bypass vulnerability in the ruby-saml library, which implements SAML single sign-on (SSO) for Ruby. The root cause is a parser differential between ReXML and Nokogiri: these XML parsers can generate entirely different document structures from the same input. This discrepancy allows an attacker to craft a SAML response that is interpreted differently by the two parsers, thereby bypassing signature validation [1][3][4].

Exploitation

To exploit this vulnerability, an attacker must possess a single valid signature that was created with the key used to validate SAML responses or assertions of the targeted organization. With that signature, the attacker can construct a malicious SAML assertion that passes signature validation due to the parser differential, effectively executing a Signature Wrapping attack. No additional authentication is required beyond possession of the valid signature [3].

Impact

Successful exploitation leads to authentication bypass, allowing the attacker to log in as any user of the affected application (account takeover). The vulnerability affects ruby-saml versions prior to 1.12.4 and 1.18.0. Patches are available in versions 1.12.4 and 1.18.0 [1][3][4].

Mitigation

Users should upgrade to ruby-saml 1.12.4 or 1.18.0 immediately. Libraries that depend on ruby-saml, such as omniauth-saml, must also be updated to versions that reference a fixed ruby-saml version [1][3].