CVE-2025-25291

🗓️ 12 Mar 2025 20:16:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 2103 Views

CVE-2025-25291 affects ruby-saml with SAML authentication bypass due to parser differential issues.

Reporter	Title	Published	Views	Family All 43
FreeBSD	Gitlab -- Vulnerabilities	12 Mar 202500:00	–	freebsd
BDU FSTEC	SAML SSO Library Authentication Bypass	17 Mar 202500:00	–	bdu_fstec
Circl	CVE-2025-25291	12 Mar 202520:07	–	circl
CNNVD	OneLogin ruby-saml security vulnerability	12 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-25291 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)	12 Mar 202520:16	–	cvelist
Debian	[SECURITY] [DLA 4115-1] ruby-saml security update	4 Apr 202523:21	–	debian
Debian CVE	CVE-2025-25291	12 Mar 202520:16	–	debiancve
Tenable Nessus	Debian dla-4115 : ruby-saml - security update	4 Apr 202500:00	–	nessus
Tenable Nessus	FreeBSD : Gitlab -- Vulnerabilities (a435609c-ffd5-11ef-b4e4-2cf05da270f3)	14 Mar 202500:00	–	nessus
Tenable Nessus	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RubySAML vulnerabilities (USN-7409-1)	2 Apr 202500:00	–	nessus

NVD

Vulners

Node

omniauth omniauth_samlRange<1.10.6ruby

omniauth omniauth_samlRange2.0.0–2.1.3ruby

omniauth omniauth_samlRange2.2.0–2.2.3ruby

onelogin ruby-samlRange<1.12.4

onelogin ruby-samlRange1.13.0–1.18.0

Node

netapp storagegridMatch-

[
  {
    "vendor": "SAML-Toolkits",
    "product": "ruby-saml",
    "versions": [
      {
        "version": "< 1.12.4",
        "status": "affected"
      },
      {
        "version": ">= 1.13.0, < 1.18.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
github	www.github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9
securitylab	www.securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-saml
github	www.github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm
github	www.github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
github	www.github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
github	www.github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
about	www.about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
portswigger	www.portswigger.net/research/saml-roulette-the-hacker-always-wins
github	www.github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97