ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Omniauth_saml | Omniauth | * | 1.10.6 (excluding) |
| Omniauth_saml | Omniauth | 2.0.0 (including) | 2.1.3 (excluding) |
| Omniauth_saml | Omniauth | 2.2.0 (including) | 2.2.3 (excluding) |
| Ruby-saml | Onelogin | * | 1.12.4 (excluding) |
| Ruby-saml | Onelogin | 1.13.0 (including) | 1.18.0 (excluding) |
| Ruby-saml | Ubuntu | esm-apps/bionic | * |
| Ruby-saml | Ubuntu | esm-apps/focal | * |
| Ruby-saml | Ubuntu | esm-apps/jammy | * |
| Ruby-saml | Ubuntu | esm-apps/noble | * |
| Ruby-saml | Ubuntu | esm-apps/xenial | * |
| Ruby-saml | Ubuntu | focal | * |
| Ruby-saml | Ubuntu | jammy | * |
| Ruby-saml | Ubuntu | noble | * |
| Ruby-saml | Ubuntu | oracular | * |
| Ruby-saml | Ubuntu | plucky | * |
| Ruby-saml | Ubuntu | upstream | * |
Related Attack Patterns
References
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
- https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9
- https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
- https://portswigger.net/research/saml-roulette-the-hacker-always-wins
- https://securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-saml
- https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
- https://news.ycombinator.com/item?id=43374519
- https://security.netapp.com/advisory/ntap-20250314-0010/