CVE detail
CVE-2025-25292
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 27.7 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
15 source links · newest first
- GitLab addressed critical auth bypass flaws in CE and EESecurity Affairs
GitLab addressed two critical authentication bypass vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). GitLab released security updates to address critical vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). The company addressed nine vulnerabilities, including the two critical ruby-saml authentication bypass issues respectively tracked as CVE-2025-25291 and CVE-2025-25292. GitLab CE/EE versions 17.7.7, 17.8.5, […]
newssecurityaffairs.comMar 13, 2025, 10:05 PM - https://security.netapp.com/advisory/ntap-20250314-0009/security.netapp.com
No excerpt available.
Vendor Advisorysecurity.netapp.comMar 12, 2025, 9:15 PM - https://news.ycombinator.com/item?id=43374519news.ycombinator.com
No excerpt available.
Issue Trackingnews.ycombinator.comMar 12, 2025, 9:15 PM No excerpt available.
Vendor Advisorylists.debian.orgMar 12, 2025, 9:15 PM- https://securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-samlsecuritylab.github.com
No excerpt available.
Exploitsecuritylab.github.comMar 12, 2025, 9:15 PM No excerpt available.
Exploitportswigger.netMar 12, 2025, 9:15 PMNo excerpt available.
Exploitgithub.comMar 12, 2025, 9:15 PMNo excerpt available.
Exploitgithub.comMar 12, 2025, 9:15 PMNo excerpt available.
Exploitgithub.comMar 12, 2025, 9:15 PMNo excerpt available.
Exploitgithub.comMar 12, 2025, 9:15 PM- https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97github.com
No excerpt available.
Exploitgithub.comMar 12, 2025, 9:15 PM - https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9github.com
No excerpt available.
Exploitgithub.comMar 12, 2025, 9:15 PM No excerpt available.
Exploitgithub.blogMar 12, 2025, 9:15 PMNo excerpt available.
Vendor Advisoryabout.gitlab.comMar 12, 2025, 9:15 PMCritical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. In this blog post, we’ll shed light on how these vulnerabilities that rely on a parser differential were uncovered.
vendorgithub.blogMar 12, 2025, 9:07 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2025-25291CVSS 9.3 · Critical
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4…
- CVE-2024-45409CVSS 10.0 · Critical
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Res…
- CVE-2026-42462CVSS 7.0 · High
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of…
- CVE-2025-66568CVSS 9.3 · Critical
The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonic…
- CVE-2025-66567CVSS 9.3 · Critical
The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due…
- CVE-2024-21988CVSS 5.3 · Medium
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vuln…