Identity CVE · SAML
CVE-2025-54572ruby-saml auth bypass, incomplete fix of CVE-2025-25292
critical
Product: ruby-samlVendor: SAML-ToolkitsCWE-347Disclosed: 2025-07-30Status: PatchedProtocol deep diveNVD ↗
What broke
The March 2025 ruby-saml patches for CVE-2025-25291 and CVE-2025-25292 left a parser-differential path open. CVE-2025-54572 is that leftover: an attacker can still construct a SAML response that verifies on one XML tree and authenticates as a different user on the other.
Why it matters
Incomplete fixes are how signature-wrapping stays in production for a year. Teams that closed the March ticket and moved on were still impersonable. This is also why "we patched ruby-saml in Q1" is not an answer an auditor should accept in late 2025.
What to do
- Confirm the running version is 1.18.1 or later, not "we patched in March."
- Re-test ACS handling with a known wrapping fixture after every library bump. Regression tests are how you catch the next incomplete fix, including CVE-2025-66567.
- Rotate signing keys if the SP was reachable while on the incomplete patch.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.