Identity CVE · SAML
CVE-2025-25292ruby-saml companion signature-wrapping bypass
critical · CVSS 10.0
Product: ruby-samlVendor: SAML-ToolkitsCWE-347Disclosed: 2025-03-12Status: PatchedProtocol deep diveNVD ↗
What broke
CVE-2025-25292 is the companion to CVE-2025-25291: a second way to wrap a signed SAML assertion so ruby-saml accepts an attacker-controlled NameID or attribute statement. Same root cause family (parser disagreement, CWE-347 improper verification of cryptographic signature), same March 2025 patch train.
The March fix did not hold. CVE-2025-54572 is the incomplete-fix follow-on, and PortSwigger's December 2025 "The Fragile Lock" work produced CVE-2025-66567 and CVE-2025-66568.
Why it matters
If you patched 25291 and assumed you were done, you were not. Signature wrapping is a class, not a single line of code. Identity teams that treat each ruby-saml CVE as a one-time ticket will keep reopening it.
What to do
- Treat the ruby-saml series as one upgrade: land on 1.18.1 or later, not on the first patched minor.
- After any SAML library upgrade, rotate signing certificates at the identity provider.
- Add a detection story: SSO assertions whose signed XML and consumed XML do not match, or logins whose NameID never appeared in a prior valid assertion for that session.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.