CVE-2025-25291 Details
Description
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
A critical authentication bypass vulnerability has been identified in the Ruby-SAML library, which is used by GitLab for SAML single sign-on (SSO) authentication. This vulnerability, present in Ruby-SAML versions prior to 1.12.4 and 1.13.0 through 1.18.0, arises from a parser differential between REXML and Nokogiri, which can be exploited to execute a Signature Wrapping attack. As a result, an attacker with access to a valid signed SAML document can impersonate another user, potentially leading to unauthorized access or data manipulation.
Users of the Ruby-SAML library should update to version 1.18.0, which addresses the vulnerability by ensuring consistent parsing and validation of SAML documents. GitLab has released versions 17.9.2, 17.8.5, and 17.7.7 that include this patch. Affected GitLab customers should upgrade to one of these versions immediately.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| omniauth omniauth saml | < 1.10.6 >= 2.0.0, < 2.1.3 >= 2.2.0, < 2.2.3 |
CPE
Remediation
| |
| onelogin ruby-saml | < 1.12.4 >= 1.13.0, < 1.18.0 |
CPE
Remediation
| |
| netapp storagegrid | All versions |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 26, 2025 | Modified Analysis | [email protected] |
| Sep 12, 2025 | CVE Modified | [email protected] |
| Aug 1, 2025 | Initial Analysis | [email protected] |
| Mar 20, 2025 | CVE Modified | [email protected] |
| Mar 15, 2025 | CVE Modified | CVE |
| Mar 14, 2025 | CVE Modified | CVE |
| Mar 12, 2025 | CVE Modified | [email protected] |
| Mar 12, 2025 | New CVE Received | [email protected] |