Login Request a demo
High severity · published Mar 12, 2025
CVE-2025-25293
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Omniauth Saml · Omniauth
before 1.10.6; 2.0.0 before 2.1.3; 2.2.0 before 2.2.3 · source: NVD
RU
Ruby-saml · Onelogin
before 1.12.4; 1.13.0 before 1.18.0 · source: NVD
Affected product
OS
Omniauth Saml
Omniauth
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25293
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-25293
Patch
https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
Exploit
https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
Patch
https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
Patch
https://github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140a67e2b3eb1
Release Notes
https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
Release Notes
https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
More from Omniauth Saml
9.8
CVE-2025-25292
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
9.8
CVE-2025-25291
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
9.8
CVE-2024-45409
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
9.8
CVE-2017-11430
OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to…