Loading vulnerability…
SAML Signature Wrapping Authentication Bypass in ruby-saml
CVE-2025-25291 is an authentication-bypass vulnerability in ruby-saml caused by an XML parser differential between REXML and Nokogiri. The parsers can construct different document structures from the same XML input, enabling a SAML Signature Wrapping attack in which signature validation can apply to a legitimate signed element while application logic processes an attacker-controlled assertion. A successful attack can cause the relying application to authenticate the attacker as another user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables authentication bypass and impersonation of a user in the affected SAML identity-provider environment. This can grant the attacker the access available to the impersonated account.
If you can’t patch tonight, do this now.
Where immediate upgrading is not possible, restrict or disable affected SAML SSO integrations where operationally feasible. For GitLab deployments, enable GitLab two-factor authentication, disable the SAML two-factor-bypass option, and require administrator approval for automatically created users. Identity-provider MFA alone does not mitigate this flaw.
Patch, then assume compromise.
Upgrade ruby-saml to version 1.12.4 or later on the 1.12.x release line, or to version 1.18.0 or later on later release lines. Applications using omniauth-saml should upgrade to a fixed omniauth-saml release and ensure that its resolved ruby-saml dependency is version 1.18.0 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.