NetSight
IP …
critical9.8

CVE-2025-25291

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

Impact

### Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. ### Impact This issue may lead to authentication bypass.

Affected packages

EcosystemPackageAffectedFixed in
rubygemsruby-saml< 1.12.41.12.4

Affected products

VendorProductAffected versions
OmniauthOmniauth Saml
before 1.10.6
from 2.0.0 before 2.1.3
from 2.2.0 before 2.2.3
OneloginRuby-Saml
before 1.12.4
from 1.13.0 before 1.18.0
NetappStoragegrid
All versions

Weakness classification

CWE-347CWE-436

References