Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-25292

67
FAUCET Score

CVE-2025-25292 is an authentication bypass vulnerability in ruby-saml, affecting versions prior to 1.12.4 and 1.18.0, and consequently impacting products like NetApp, OmniAuth, and OneLogin offerings that utilize ruby-saml. This critical vulnerability (CVSS 9.8) stems from a parser differential between REXML and Nokogiri, enabling Signature Wrapping attacks that can lead to complete authentication bypass. While there is no evidence of active exploitation in the wild, the vulnerability has garnered significant community discussion and media coverage, with a public demonstration of its impact on high-profile projects like GitLab. No public exploit code (Metasploit, Nuclei, ExploitDB) is currently available, and it is not listed on the CISA KEV catalog.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.10.6CPE matchmatch criteria
cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*
>= 2.0.0, < 2.1.3CPE matchmatch criteria
cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*
>= 2.2.0, < 2.2.3CPE matchmatch criteria
cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*
< 1.12.4CPE matchmatch criteria
cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*
>= 1.13.0, < 1.18.0CPE matchmatch criteria
cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

9.3CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
63.79%
Probability of exploitation in next 30 days
EPSS Percentile
99.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.6379 is in the 97th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
rubygemspatch availablevia ghsa
Product: ruby-samlFixed in: 1.18.0
rubygemspatch availablevia ghsa
Product: ruby-samlFixed in: 1.12.4

Vendor Advisories (1)

rubygemsGHSA-754f-8gm6-c4r2critical

Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

Mar 12, 2025

References

lists.debian.org / debian-lts-announce/2025/04/msg00011.html
news.ycombinator.com / item
Issue Tracking
security.netapp.com / advisory/ntap-20250314-0009
Third Party Advisory
about.gitlab.com / releases/2025/03/12/patch-release-gitlab-17-9-2-released
Patch
github.blog / security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
ExploitThird Party Advisory
github.com / omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
Vendor Advisory
github.com / SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9
Patch
github.com / SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
Patch
github.com / SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
Release Notes
github.com / SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
Release Notes
github.com / SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2
Vendor Advisory
portswigger.net / research/saml-roulette-the-hacker-always-wins
ExploitThird Party Advisory
securitylab.github.com / advisories/GHSL-2024-329_GHSL-2024-330_ruby-saml
Third Party Advisory