Identity CVE · SAML
CVE-2024-45409ruby-saml 2024 auth bypass (ahacker1), still in the blast radius
critical · CVSS 10.0
Product: ruby-samlVendor: SAML-ToolkitsCWE-347Disclosed: 2024-09-10Status: PatchedProtocol deep diveNVD ↗
What broke
CVE-2024-45409 is the 2024 ruby-saml authentication bypass widely discussed as "ahacker1." A crafted SAML response let an attacker authenticate as any user. CVSS 10.0. It was patched in 2024, then the 2025 series (CVE-2025-25291 and friends) showed the same library still had wrapping paths.
Why it matters
We keep this brief in a 2025-2026 catalog because defenders still find the old gem in lockfiles, vendor appliances, and internal tools that nobody has rebuilt since 2023. The 2025 CVEs are easier to explain once you have seen this one.
What to do
- If ruby-saml is older than the 2024 patched line, you are not in the 2025 conversation yet. Upgrade to 1.18.1 in one step.
- Search container images and vendor appliances, not only application repos. This library hides in GitLab, ticketing tools, and homegrown SSO gateways.
Sources
Related identity CVEs
- CVE-2025-54572ruby-saml auth bypass, incomplete fix of CVE-2025-25292
- CVE-2025-25292ruby-saml companion signature-wrapping bypass
- CVE-2025-25291ruby-saml parser differential enables signature wrapping
- CVE-2024-8698Keycloak SAML signature validation bypass
- CVE-2024-4985GitHub Enterprise Server SAML encrypted-assertion bypass
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.