Authentication Bypass Vulnerability in ruby-saml by SAML Toolkits

CVE-2025-25292

What is CVE-2025-25292?

An authentication bypass vulnerability exists in the ruby-saml library, which provides SAML single sign-on (SSO) capabilities. Due to differences in XML parsing between ReXML and Nokogiri, an attacker could exploit this discrepancy to perform a Signature Wrapping attack. This vulnerability affects versions of ruby-saml prior to 1.12.4 and 1.18.0, allowing unauthorized access if not patched. The issue is addressed in the specified versions, making it essential for users to update their installations to mitigate potential risks. For more details on the security patch, please refer to the official repositories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

News Articles

Security Affairs

CVE-2025-25291CVE-2025-25292

GitLab addressed critical auth bypass flaws in CE and EE)

GitLab addressed two critical authentication bypass vulnerabilities in Community Edition (CE) and Enterprise Edition (EE).

References