CVE-2025-25292

CRITICALNVD 9.89.8—
EchelonGraph scoreMEDIUM confidence

This critical-severity CVE scores 9.8 under NVD CVSS v3. EPSS exploit probability: 4.1%, top 11% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, nvd
Elevated
9.8
EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.
  • High exploitation likelihood — EPSS 64%
CISA-KEV: Not listedEPSS: 64%CVSS: 9.8Exploit: NoneExposed: 0

A fix is available — apply it.

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.

CVSS v3
9.8
EG Score
9.8(medium)
EPSS
99.1%
KEV
Not listed

Published

March 12, 2025

Last Modified

November 3, 2025

Advisory Details (10)

Auto-updated May 31, 2026
🔬 Proof of concept available. Patch available. Sources: github_release, github, github_commit.
github

GHSL-2024-329_GHSL-2024-330: Authentication bypasses in ruby-saml - CVE-2025-25291, CVE-2025-25292 | GitHub Security Lab

https://securitylab.github.com/advisories/GHSL-2024-329_GHSL-2024-330_ruby-saml
generic Patch Available

SAML roulette: the hacker always wins | PortSwigger Research

https://portswigger.net/research/saml-roulette-the-hacker-always-wins
github Patch Available

Signature Wrapping Attack issue on ruby-saml · Advisory · omniauth/omniauth-saml · GitHub

https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
github Patch Available

SAML authentication bypass due to namespace handling (parser differential) · Advisory · SAML-Toolkits/ruby-saml · GitHub

https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2
github_release Patch Available

1.18.0 (Mar 12, 2025)

Patch available: SAML-Toolkits/ruby-saml v1.18.0

https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
github_release Patch Available

1.12.4 (Mar 12, 2025)

Patch available: SAML-Toolkits/ruby-saml v1.12.4

https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
github_commit Patch Available

commit e9c1cdbd0f9a (SAML-Toolkits/ruby-saml)

Patch available: SAML-Toolkits/ruby-saml v1.18.0 (contains commit e9c1cdbd0f9a)

https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
github_commit Patch Available

commit e76c5b36bac4 (SAML-Toolkits/ruby-saml)

Patch available: SAML-Toolkits/ruby-saml v1.12.4 (contains commit e76c5b36bac4)

https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9
generic🟡 PoC Available

Sign in as anyone: Bypassing SAML SSO authentication with parser differentials - The GitHub Blog

https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
generic

GitLab release notes | GitLab Docs

https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released

Vendor Advisories for CVE-2025-25292(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(1)

Vendor / EcosystemFixed in / PatchReleasedSource
ubunturuby-saml (1.11.0-1ubuntu0.1+esm1) @ focal2026-05-30ubuntu

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Affected Packages

(1 across 1 ecosystem)
RubyGems(1)
PackageVulnerable rangeFixed inDependents
ruby-saml0.0.5 ... 1.9.0 (81 versions)1.12.4—

Weakness Classification(2)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

All Vendor Advisories

(1)

Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.

Data Freshness Timeline

(refreshed 5× in last 7d / 32× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-07-07 07:51 UTCOSV refresh
  2. 2026-07-06 02:22 UTCEPSS rescore
  3. 2026-07-06 02:22 UTCEPSS rescore
  4. 2026-07-04 06:30 UTCEPSS rescore
  5. 2026-07-01 15:06 UTCEPSS rescore
  6. 2026-06-28 04:55 UTCEPSS rescore
  7. 2026-06-28 04:55 UTCEPSS rescore
  8. 2026-06-27 03:08 UTCEPSS rescore
  9. 2026-06-27 03:08 UTCEPSS rescore
  10. 2026-06-25 13:49 UTCEPSS rescore
  11. 2026-06-25 13:49 UTCEPSS rescore
  12. 2026-06-23 21:32 UTCEPSS rescore
  13. 2026-06-23 21:32 UTCEPSS rescore
  14. 2026-06-21 01:59 UTCEPSS rescore
  15. 2026-06-21 01:59 UTCEPSS rescore
  16. 2026-06-18 18:44 UTCOSV refresh
  17. 2026-06-18 17:52 UTCEPSS rescore
  18. 2026-06-18 17:52 UTCEPSS rescore
  19. 2026-06-17 17:52 UTCEPSS rescore
  20. 2026-06-16 17:52 UTCEPSS rescore
  21. 2026-06-16 17:52 UTCEPSS rescore
  22. 2026-06-15 17:48 UTCEPSS rescore
  23. 2026-06-14 23:17 UTCEPSS rescore
  24. 2026-06-13 22:59 UTCEPSS rescore
  25. 2026-06-12 23:11 UTCEPSS rescore
Show 27 more
  1. 2026-06-11 13:59 UTCEPSS rescore
  2. 2026-06-10 22:18 UTCEPSS rescore
  3. 2026-06-10 13:22 UTCEPSS rescore
  4. 2026-06-08 14:16 UTCEPSS rescore
  5. 2026-06-08 14:16 UTCEPSS rescore
  6. 2026-06-07 15:24 UTCEPSS rescore
  7. 2026-06-07 15:24 UTCEPSS rescore
  8. 2026-06-06 13:47 UTCEPSS rescore
  9. 2026-06-06 13:47 UTCEPSS rescore
  10. 2026-06-05 22:46 UTCEPSS rescore
  11. 2026-06-05 22:46 UTCEPSS rescore
  12. 2026-06-05 06:10 UTCEPSS rescore
  13. 2026-06-05 06:10 UTCEPSS rescore
  14. 2026-06-04 13:11 UTCEPSS rescore
  15. 2026-06-04 13:11 UTCEPSS rescore
  16. 2026-06-02 20:12 UTCEPSS rescore
  17. 2026-06-02 20:12 UTCEPSS rescore
  18. 2026-06-01 13:51 UTCEPSS rescore
  19. 2026-06-01 13:51 UTCEPSS rescore
  20. 2026-05-31 22:30 UTCEPSS rescore
  21. 2026-05-31 22:30 UTCEPSS rescore
  22. 2026-05-31 00:16 UTCEPSS rescore
  23. 2026-05-31 00:16 UTCEPSS rescore
  24. 2026-05-30 09:37 UTCEG score recompute
  25. 2026-05-30 09:37 UTCVendor advisory
  26. 2026-05-29 16:50 UTCOSV refresh
  27. 2026-05-29 13:44 UTCEPSS rescore

Frequently asked(5)

What is CVE-2025-25292?
CVE-2025-25292 is a critical vulnerability published on March 12, 2025. ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely…
When was CVE-2025-25292 disclosed?
CVE-2025-25292 was first published in the National Vulnerability Database on March 12, 2025, with the most recent update on November 3, 2025. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2025-25292 actively exploited?
CVE-2025-25292 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 99.1% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2025-25292?
CVE-2025-25292 has a CVSS v3 base score of 9.8 (NVD).
How do I remediate CVE-2025-25292?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2025-25292, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2025-25292

Explore →

Is Your Infrastructure Affected by CVE-2025-25292?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs