CVE-2025-25292: ruby-saml parser differential enables SAML signature wrapping auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 4.0 score of 9.3 with no authentication or user interaction required, and public exploit research plus very high EPSS make this an urgent authentication bypass.

What it is

ruby-saml before 1.12.4 and 1.18.0 is vulnerable to an authentication bypass caused by a parser differential between ReXML and Nokogiri, which can produce different document structures from the same XML input. This allows a Signature Wrapping attack that defeats SAML assertion signature verification, letting an attacker impersonate a user. The flaw is rated CVSS 4.0 9.3 (critical) and affects ruby-saml, omniauth-saml and NetApp StorageGRID.

Impact

An attacker can bypass SAML SSO authentication and sign in as an arbitrary user, including administrative accounts, without valid credentials. This grants access to whatever the impersonated identity is authorized to reach.

Attack surface

Reachable over the network via crafted SAML responses submitted to the service provider's assertion consumer endpoint; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The attacker needs the ability to deliver a malicious SAML response to the SP.

Exploitation

Not listed in CISA KEV, but EPSS is 0.65086 (99.2nd percentile), indicating high predicted exploitation activity. Multiple references are tagged Exploit, including GitHub Security Lab and PortSwigger research, so public exploitation detail exists.

What to do

• Upgrade ruby-saml to 1.12.4 or 1.18.0 (or later) immediately; apply the linked commits if a version bump is not possible.
• Upgrade omniauth-saml and any bundled ruby-saml dependency, and apply the GitLab patch release if running GitLab.
• Apply the NetApp StorageGRID advisory fix if StorageGRID is deployed.
• Ensure only one XML parser is used consistently for signature verification and document processing to avoid parser differentials.
• Verify SAML assertion signatures against the exact signed element and reject responses with multiple or wrapped assertions.

Detection

• Monitor SAML responses for duplicate or nested Assertion elements and signatures that do not cover the consumed assertion.
• Alert on successful SSO logins where the assertion ID, issuer or subject does not match the expected IdP or session context.
• Log and review XML parser errors or mismatches between ReXML and Nokogiri parsing paths in ruby-saml.
• Hunt for anomalous authentication from new source IPs or user agents immediately following SAML response processing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.