Authentication Bypass Vulnerability in ruby-saml via XML Signature Wrapping Attack
A vulnerability exists in ruby-saml, a security assertion markup language (SAML) single sign-on (SSO) library for Ruby. Prior to versions 1.12.4 and 1.18.0, the library has an authentication bypass issue caused by different XML parsing behaviors between ReXML and Nokogiri. These parsers can generate distinct document structures from the same XML input, which enables an attacker to perform a Signature Wrapping attack. This vulnerability potentially allows authentication bypass, compromising the security of the SSO process. The developers addressed the problem in versions 1.12.4 and 1.18.0 by implementing a patch to resolve the parsing discrepancies.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
saml-toolkits ruby-saml |
GitLab patches critical authentication bypass vulnerabilities By Bill Toulas March 13, 2025 12:13 PM 0 GitLab released security updates for Community Edition (CE) and Enterprise Edition (EE), fixing nine vulnerabilities, among which two critical severity ruby-saml library authentication bypass flaws. All flaws were addressed in GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2, while all versions before those are vulnerable. GitLab.com is already patched, and GitLab Dedicated customers will...
Vulmon