GitStock

saml-toolkits/ruby-saml · Security

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

GHSA ID
GHSA-4vc4-m8qh-g8jm
CVE ID
CVE-2025-25291
Severity
critical
Published
Updated
CVSS
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Summary

An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

Impact

This issue may lead to authentication bypass.

CWEs

  • CWE-347 · Improper Verification of Cryptographic Signature
  • CWE-436 · Interpretation Conflict

References

Open GitHub