ruby-saml vulnerabilities

6 known vulnerabilities in ruby-saml from SAML-Toolkits. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  ruby-saml: Improper Verification of Cryptographic Signature

  CVE-2025-66568Dec 9, 2025SAML-Toolkits

  The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an a

• 9.1 Critical severity

  ruby-saml: Improper Verification of Cryptographic Signature

  CVE-2025-66567Dec 9, 2025SAML-Toolkits

  The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differentl

• 7.5 High severity

  ruby-saml: Uncontrolled Resource Consumption

  CVE-2025-25293Mar 12, 2025SAML-ToolkitsEPSS 1.53%

  ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML r

• 9.8 Critical severity

  ruby-saml: Improper Verification of Cryptographic Signature

  CVE-2025-25292Mar 12, 2025SAML-ToolkitsEPSS 65.1%

  ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently

• 9.8 Critical severity

  ruby-saml: Improper Verification of Cryptographic Signature

  CVE-2025-25291Mar 12, 2025SAML-ToolkitsEPSS 21%

  ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently

• 9.8 Critical severity

  ruby-saml: Improper Verification of Cryptographic Signature

  CVE-2024-45409Sep 10, 2024SAML-ToolkitsEPSS 12.5%

  The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by th