Skip to content
OpenAdvisories

Package · Debian

ruby-saml

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-25292 EPSS 65%

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 9.3
    CVE-2025-25291 EPSS 21%

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 10.0
    CVE-2024-45409 Public exploit EPSS 11%

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by t…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2015-20108

    ruby-saml vulnerable to XPath injection

    xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.

    ruby-saml ruby-saml Debian RubyGems