# ruby-saml 2024 auth bypass (ahacker1), still in the blast radius

Source: https://startwithidentity.com/cves/cve-2024-45409/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2024-45409 is the 2024 ruby-saml authentication bypass widely discussed as "ahacker1." A crafted [SAML](https://startwithidentity.com/glossary/saml/) response let an attacker authenticate as any user. CVSS 10.0. It was patched in 2024, then the 2025 series ([CVE-2025-25291](https://startwithidentity.com/cves/cve-2025-25291/) and friends) showed the same library still had wrapping paths.

## Why it matters

We keep this brief in a 2025-2026 catalog because defenders still find the old gem in lockfiles, vendor appliances, and internal tools that nobody has rebuilt since 2023. The 2025 CVEs are easier to explain once you have seen this one.

## What to do

- If ruby-saml is older than the 2024 patched line, you are not in the 2025 conversation yet. Upgrade to 1.18.1 in one step.
- Search container images and vendor appliances, not only application repos. This library hides in GitLab, ticketing tools, and homegrown SSO gateways.

## After you patch

A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.

- **Revoke every session** issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- **Audit administrative accounts and group memberships** for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- **Rotate the identity provider signing certificate** if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- **Check your own implementation for the same class**: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See [SAML 2.0](https://startwithidentity.com/standards/saml-2-0/) and [SAML vs OIDC](https://startwithidentity.com/guides/fundamentals/saml-vs-oidc/).

## Sources

- [NVD: CVE-2024-45409](https://nvd.nist.gov/vuln/detail/CVE-2024-45409)