CVE-2025-25291: GHSL-2024-329_GHSL-2024-330: Authentication bypasses in ruby-saml - CVE-2025-25291, CVE-2025-25292
Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.
Impact This issue may lead to authentication bypass.
Other sources
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
— NVD
TitleSeverityCVE-2025-25291 and CVE-2025-25292 (third party gem ruby-saml)CriticalCVE-2025-27407 (third party gem graphql)HighDenial of Service Due to Inefficient Processing of Untrusted InputMediumCredentials disclosed when repository mirroring failsMediumDenial of Service Vulnerability in GitLab Approval Rules due to Unbounded FieldMediumInternal Notes in Merge Requests Are Emailed to Non-Members Upon Review SubmissionMediumMaintainer can inject shell code in Google integrationsLowGuest with custom Admin group member permissions can approve the users invitation despite user capsLow
— GitLab
Two different authentication bypasses were found in ruby-saml:
— GitHub Security Lab
Affected Software
Remediation
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-25291?
The severity of CVE-2025-25291 is high due to the potential for authentication bypass.
How do I fix CVE-2025-25291?
To fix CVE-2025-25291, upgrade ruby-saml to versions 1.12.4 or 1.18.0 or later.
What product is affected by CVE-2025-25291?
CVE-2025-25291 affects the ruby-saml library.
What versions of ruby-saml are impacted by CVE-2025-25291?
ruby-saml versions prior to 1.12.4 and between 1.13.0 and 1.18.0 are impacted by CVE-2025-25291.
How does CVE-2025-25291 exploit a parser differential?
CVE-2025-25291 exploits the difference in XML parsing between ReXML and Nokogiri, leading to different document structures.