CVE-2025-25291 is a critical (CVSS 9.8) authentication bypass in the ruby-saml gem, caused by a parser differential that enables a signature wrapping attack. Versions before 1.12.4, and before 1.18.0 on the newer line, are affected. Upgrade to 1.12.4 or 1.18.0, and check anything that depends on the gem.
What's affected
- Product: ruby-saml by SAML Toolkits, the Ruby library used for SAML single sign-on. The NVD record also lists OmniAuth SAML and NetApp StorageGRID.
- Affected: versions before 1.12.4 on the older line and before 1.18.0 on the current line.
- Fixed: 1.12.4 and 1.18.0, both released on 12 March 2025. The release notes list this CVE and its sibling, CVE-2025-25292, together, along with a separate denial of service fix (CVE-2025-25293) in compressed messages.
- Dependents: apps that use
omniauth-samlpull in ruby-saml. GitLab shipped patch releases 17.9.2, 17.8.5 and 17.7.7 and lists the two CVEs in its security fixes table. - NetApp: the record lists StorageGRID, so check NetApp's advisory for that product.
How to check if you're exposed
Look at the resolved version in your lockfile, not the Gemfile.
bundle list | grep -E "ruby-saml|omniauth-saml"
grep -n -A1 "ruby-saml" Gemfile.lock
bundle outdated ruby-saml
gem list ruby-saml
Anything below 1.12.4, or on the 1.13 to 1.17 range, is affected. If you use omniauth-saml, check which ruby-saml it resolved to, since the dependency is indirect. For a monorepo or many services, run the same grep across every Gemfile.lock you own.
Also check vendored copies in container images and any appliance or product you run that embeds the gem. GitLab self-managed users should check their version against the patch release listing.
What to do now
- Upgrade ruby-saml to 1.18.0, or to 1.12.4 if you must stay on the older line, then run
bundle update ruby-samland commit the lockfile. - If you use
omniauth-saml, make sure its resolved ruby-saml is at the fixed version. - Rebuild and redeploy every image and service that includes the gem, and confirm the running version, not just the repository.
- GitLab self-managed: apply patch release 17.9.2, 17.8.5 or 17.7.7, depending on your line.
- Review SSO and identity provider logs for sign-ins that do not match a real user action, especially for privileged accounts, covering the period before you patched.
- Run your SAML login tests after the upgrade, including negative cases.
Why it matters
SAML responses are signed XML documents. A service provider has to do two things with them: verify the signature, and then read the user's identity from the document. A parser differential happens when the two steps read the same bytes and come to different answers. In this case the advisory text says REXML and Nokogiri parse the same XML differently, and can produce entirely different document structures from the same input.
- CWE-347 is improper verification of a cryptographic signature. The software accepts data as signed without proving that the signature covers what it ends up using.
- CWE-436 is an interpretation conflict. Two components read the same input and come to different conclusions about what it means.
That gap makes a signature wrapping attack possible. The signature check can pass on one view of the document while the application reads identity from another view the caller influenced, which ends in authentication bypass. The impact for any app that relies on SAML for sign in is severe, because the identity provider is the front door. The GitHub Security Lab write-up on this bug is a good read on how parser differences create security holes. Neither CVE is marked as listed in CISA's Known Exploited Vulnerabilities catalog in our record.
Try it yourself
Bugs in a transitive dependency are easy to miss. This demo shows how a dependency inventory surfaces them.
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix it?
ruby-saml 1.12.4 and 1.18.0, both released on 12 March 2025.
Do I need to act if I only use omniauth-saml?
Yes. omniauth-saml depends on ruby-saml, so check which ruby-saml version resolved in your lockfile and upgrade it.
Sources
Last reviewed: 19 October 2026.
