Two critical authentication bypass vulnerabilities have been discovered in the ruby-saml library, potentially exposing numerous web applications to account takeover attacks.
Security researchers from GitHub Security Lab have identified parser differential vulnerabilities (CVE-2025-25291 and CVE-2025-25292) affecting ruby-saml versions up to 1.17.0, which could allow attackers to impersonate any user within affected systems.
GitHub reports that the vulnerabilities stem from ruby-saml’s use of two different XML parsers—REXML and Nokogiri—during the SAML response signature verification process.
This dual-parser approach creates a critical security flaw where the parsers interpret the same XML document differently, allowing attackers to manipulate verification checks.
In the affected code, ruby-saml uses REXML to extract the signature element and SignatureValue, while Nokogiri is used to extract and canonicalize the SignedInfo element.
Critical ruby-saml Vulnerabilities
The disconnect between these two operations creates an exploitable condition. When validating SAML responses, the library performs two critical checks: comparing a calculated hash against a DigestValue and verifying the SignedInfo element against the SignatureValue. The summary of both vulnerabilities is given below:
| Risk Factors | Details |
| Affected Products | ruby-saml < 1.12.4 and ≥ 1.13.0, < 1.18.0; omniauth-saml < 2.2.2, < 1.10.5 |
| Impact | Authentication bypass; Account takeover |
| Exploit Prerequisites | Possession of a single valid signature created with the target organization’s key; Can be obtained from an unprivileged user’s assertion or publicly accessible IdP metadata |
| CVSS 3.1 Score | 8.8 (High) |
Researchers discovered that an attacker could craft a malicious SAML response containing two different Signature elements—one visible to REXML and another visible to Nokogiri. The code in xml_security.rb first queries for signature elements with REXML:
Later, it queries again using Nokogiri:
Due to parser differences, these queries can return different elements from the same document.
An attacker exploits this by ensuring that a valid SignedInfo with DigestValue is verified against a legitimate signature, while simultaneously having a fabricated assertion compared against its calculated digest.
Attack Scenario
The security impact is severe. An attacker with a valid signature created with the target organization’s key can construct SAML assertions for any user.
This signature could come from a legitimate SAML response belonging to an unprivileged user or, in some cases, even from publicly accessible signed metadata of a SAML identity provider.
For example, an attacker could create a malicious SAML response containing an additional Signature element hidden within a StatusDetail element that would only be visible to Nokogiri.
This technique effectively disconnects the hash verification from the signature verification, allowing attackers to bypass authentication mechanisms and gain unauthorized access to protected resources.
The vulnerabilities have been confirmed in popular projects using ruby-saml, including GitLab. GitHub Security Lab notified GitLab’s security team to protect their users against potential attacks
Mitigations
Organizations using ruby-saml should immediately update to version 1.18.0, which contains fixes for both CVE-2025-25291 and CVE-2025-25292.
Additionally, references to libraries making use of ruby-saml, such as omniauth-saml, must be updated to versions that reference the fixed version of ruby-saml.
For developers implementing temporary mitigations, checking for Nokogiri parsing errors can help prevent some exploitation techniques:
However, this is not a complete solution, and updating to the fixed version remains the recommended approach.
The vulnerabilities were discovered through a private bug bounty engagement initiated by GitHub to evaluate the security of the ruby-saml library. Both a bug bounty participant identified as “ahacker1” and GitHub Security Lab researchers independently identified the parser differential issues.
The maintainer of ruby-saml, Sixto Martín, worked with security researchers to develop and release the fixes.
No reliable indicators of compromise have been identified, making it crucial for organizations to proactively update their implementations and monitor for suspicious SAML-based authentication attempts.
Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.
