Listen to this Post
This vulnerability is an incomplete fix for CVE-2025-25292, allowing authentication bypass via a Signature Wrapping attack. The ruby-saml library uses both ReXML and Nokogiri XML parsers. These parsers handle XML namespace declarations differently when processing a signed SAML response. An attacker can craft a malicious SAML response where critical elements like the `ds:Signature` are placed within a manipulated namespace scope. Due to parser differentials, the validation logic may see a validly signed element, while the actual authentication logic processes a different, unsigned attacker-controlled element (like a forged saml:Assertion). This discrepancy between what is validated and what is executed enables a full authentication bypass.
Platform: ruby-saml
Version: <=1.12.4
Vulnerability: Authentication Bypass
Severity: Critical
date: Dec 8 2025
Prediction: Patch available
What Undercode Say:
gem list | grep ruby-saml
Example vulnerable parsing differential
ReXML.parse("<saml:Assertion><!-- Attack --></saml:Assertion>")
Nokogiri::XML("<saml:Assertion><!-- Attack --></saml:Assertion>")
How Exploit:
Craft SAML response with malicious namespace declarations to create parser differential. Position forged unsigned `Assertion` element. Bypass signature validation via XML structure confusion.
Protection from this CVE
Upgrade to version 1.18.0 immediately.
Impact:
Full authentication bypass. Attacker gains unauthorized access as any user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
