CVE-2025-25292

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

ruby-saml is a Ruby library that implements SAML-based single sign-on. CVE-2025-25292 is an authentication-bypass flaw present in all versions prior to 1.12.4 and 1.18.0. The root cause is a parser differential: the same XML document can produce structurally different trees when processed by ReXML versus Nokogiri, enabling a signature-wrapping attack that satisfies the library’s signature checks while substituting attacker-controlled assertions.

An unauthenticated network attacker who can reach a ruby-saml service provider can submit a crafted SAML response that passes signature validation yet asserts an arbitrary identity. Successful exploitation grants the attacker a valid session under the chosen identity, bypassing the intended SSO authentication entirely. The CVSS 9.3 score reflects the absence of required privileges or user interaction and the high impact on confidentiality and integrity.

Patches released in ruby-saml 1.12.4 and 1.18.0 normalize XML handling to eliminate the differential. Corresponding updates appear in dependent products such as GitLab 17.9.2, and the project’s commit history documents the specific changes that enforce consistent document structure before signature verification.

EPSS rose from a low baseline to a peak of 0.0548 on 2025-12-11 before receding, indicating measurable post-disclosure exploitation interest that warrants renewed attention for any still-unpatched deployments.