CVE-2025-25291

Description

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.

How to fix CVE-2025-25291

To remediate CVE-2025-25291, upgrade the affected package to a fixed version below.

• —upgrade to 17.9.2 or later
• —upgrade to 1.11.0-1+deb11u2 or later
• —upgrade to 1.11.0-1+deb11u2 or later
• —upgrade to 2.2.3 or later
• —upgrade to 1.12.4 or later

Is CVE-2025-25291 being exploited?

Moderate — EPSS is 20.8%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (5)

• from 0, < 17.9.2
• from 0, < 1.11.0-1+deb11u2
• from 0, < 1.11.0-1+deb11u2
• >= 2.2.0, < 2.2.3
• from 0, < 1.12.4

CVSS scores

References (25)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-25291
• ADVISORYsecuritylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-saml
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-25291
• PATCHgithub.com/omniauth/omniauth-saml
• PATCH