Loading vulnerability…
ruby-saml XML Signature Wrapping Authentication Bypass
CVE-2025-25292 is an authentication-bypass vulnerability in ruby-saml caused by an XML parser differential between REXML and Nokogiri. The parsers can construct different document structures from the same SAML XML input, enabling an XML Signature Wrapping attack in which signature validation applies to a legitimate signed element while the application processes an attacker-controlled assertion. Affected versions are ruby-saml releases before 1.12.4 in the pre-1.13 branch and before 1.18.0 in later branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to satisfy the SAML signing-related preconditions can bypass SAML authentication and impersonate another valid user within the affected SAML identity-provider environment. The attacker obtains the access and privileges associated with the impersonated account.
If you can’t patch tonight, do this now.
For affected GitLab deployments that cannot immediately upgrade, enable GitLab two-factor authentication for all users, disable the SAML two-factor-authentication bypass option, and require administrator approval for automatically created users. Identity-provider MFA alone does not mitigate this vulnerability.
Patch, then assume compromise.
Upgrade ruby-saml to version 1.18.0 or later for the 1.13.x and later branch, or to version 1.12.4 or later for branches before 1.13.0. Applications using omniauth-saml should also upgrade to a fixed omniauth-saml release and ensure that dependency resolution selects ruby-saml 1.18.0 or later where applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.