Start with Identity
Subscribe
Identity CVE · SAML

CVE-2025-25291ruby-saml parser differential enables signature wrapping

critical · CVSS 10.0
Product: ruby-samlVendor: SAML-Toolkits / GitLabCWE-347Disclosed: 2025-03-12Status: PatchedProtocol deep diveNVD ↗

What broke

ruby-saml parsed the same SAML response with two XML stacks, ReXML and Nokogiri. They do not agree on which node is "the" signed assertion. An attacker who already has one valid signature (a normal SSO login) can wrap a new assertion around it. The verifier checks the signature on one tree and consumes attributes from the other. GitHub Security Lab's summary is the one to remember: "in possession of a single valid signature [the attacker] can construct SAML assertions themselves and log in as any user."

Patched in ruby-saml 1.12.4 and 1.18.0 (March 2025). GitLab and omniauth-saml were in the blast radius because they vendor or depend on the library.

Why it matters

This is not a one-off coding error. It is a parser differential, the same family as the 2024 ruby-saml bypass (CVE-2024-45409) and the incomplete fix that became CVE-2025-54572. SAML 2.0 is still how a large share of workforce SSO works. If your IdP or a SaaS SP is on an unpatched ruby-saml, every account is impersonable, including admins.

What to do

  • Upgrade ruby-saml to 1.18.1 or later. 1.12.4 / 1.18.0 closed this pair but later bypasses (CVE-2025-66567, CVE-2025-66568) landed in December 2025.
  • Rotate IdP signing keys after you patch. A leaked or captured valid signature is enough to build the wrap.
  • Inventory every SP that uses omniauth-saml, GitLab SAML, or a homegrown ruby-saml integration. Library upgrades in the IdP do not save a SaaS app that still verifies assertions itself.
  • Prefer a single XML stack. Dual parsers are a recurring SAML footgun.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.