Skip to content
OpenAdvisories

Package · RubyGems

omniauth-saml

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical —
    GHSA-hw46-3hmr-x9xv

    omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

    ### Summary There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml. The fix will be applied to ruby-saml an…

    omniauth-saml RubyGems
  • Critical 10.0
    GHSA-cvp8-5r8g-fhvq

    omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

    ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a [new r…

    omniauth-saml RubyGems
  • High 7.7
    CVE-2017-11430

    Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

    OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the …

    omniauth OmnitAuth-SAML omniauth-saml RubyGems