High-Severity Vulnerabilities Discovered in Ruby-SAML Library: What You Need to Know

A major security vulnerability has been identified in the open-source ruby-saml library, which is crucial for SAML (Security Assertion Markup Language) authentication. This library is widely used in systems supporting single sign-on (SSO), a mechanism that allows users to access multiple services with just one set of credentials. If exploited, these vulnerabilities could allow attackers to bypass authentication protections, leading to potential account takeovers. This article provides an overview of the flaws, their potential risks, and the latest updates to mitigate these threats.

Overview of the Vulnerabilities

Two critical security flaws, tracked as CVE-2025-25291 and CVE-2025-25292, have been discovered in ruby-saml. These vulnerabilities could allow malicious actors to bypass authentication mechanisms that rely on Security Assertion Markup Language (SAML). The flaws have been assigned a CVSS (Common Vulnerability Scoring System) score of 8.8 out of 10, indicating their severity.

The affected versions of ruby-saml are:

– Versions earlier than 1.12.4

– Versions between 1.13.0 and 1.18.0 (excluding 1.18.0)

The root cause of the vulnerabilities lies in how two XML parsers, REXML and Nokogiri, handle XML differently. These parsers generate distinct document structures from identical XML input. This inconsistency enables attackers to carry out a “Signature Wrapping” attack, bypassing authentication controls.

The issues were first identified and reported by GitHub Security Lab in November 2024. GitHub’s researchers highlighted that attackers could exploit these vulnerabilities to conduct account takeover attacks. The flaws were patched in versions 1.12.4 and 1.18.0 of ruby-saml, and the latest updates also fix a related remote denial-of-service (DoS) vulnerability (CVE-2025-25293) with a CVSS score of 7.7.

What Undercode Says: Analysis of the ruby-saml Vulnerabilities

The ruby-saml vulnerabilities highlight the ongoing risks inherent in XML parsing. The fact that two different parsers (REXML and Nokogiri) treat the same XML input differently creates a window of opportunity for attackers to manipulate the document in a way that the security validation process does not catch.

Signature Wrapping attacks are a particularly concerning issue, as they allow attackers to forge SAML assertions using a single valid signature. By manipulating these assertions, malicious actors can gain unauthorized access to user accounts within an organization. This type of attack bypasses the standard authentication mechanisms and can lead to widespread security breaches, especially in environments where SSO is implemented.

One key takeaway from this vulnerability is the importance of maintaining secure and up-to-date libraries. The ruby-saml project, alongside GitHub’s proactive research, has addressed these critical flaws with timely patches, yet the vulnerabilities could have caused significant damage if left unchecked. Organizations relying on ruby-saml for SSO need to prioritize updating to the latest versions (1.12.4 or 1.18.0) to protect against these attacks.

Another important consideration is the role of parser differential issues in security flaws. This kind of issue underscores the complexity of XML-based security mechanisms, where seemingly minor differences in how XML documents are processed can have profound implications for security.

Additionally, the remote DoS vulnerability adds another layer of risk, as it could allow attackers to disrupt services and cause downtime, further exacerbating the security risks for businesses using ruby-saml.

These vulnerabilities are a reminder that security flaws often emerge in seemingly innocuous areas, such as XML parsing, and can lead to severe consequences. In this case, the connection between the parser behavior and the authentication bypass shows how nuanced and complex security challenges can be.

Fact Checker Results: Validation of the ruby-saml Security Flaws

Vulnerabilities confirmed: CVE-2025-25291, CVE-2025-25292, and CVE-2025-25293 are legitimate, high-severity flaws as reported by GitHub and corroborated by the ruby-saml team.
Attack vectors: Attackers could exploit the parser differential for Signature Wrapping and perform DoS attacks, as per GitHub’s detailed analysis.
Patch availability: Security updates have been released in ruby-saml versions 1.12.4 and 1.18.0, addressing all reported vulnerabilities.