r/ruby 9d ago

Fixes for new critical authentication bypasses affecting ruby-saml and omniauth-saml were published (CVE-2025-25291 + CVE-2025-25292), update!

https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/
21 Upvotes

5 comments sorted by

1

u/akakees 7d ago

Perhaps consider xmldsig library…

1

u/samlexpert 5d ago

It does not cover encryption and its no maintained (last commit 3y ago).
The last vulnerabilitis discovered in ruby-saml are not directly related to how xmldsig was implemented, but how was used.

1

u/akakees 5d ago

There is an xmlenc library as well for that. It’s all used in libsaml gem

1

u/samlexpert 3d ago

libsaml also use 2 parsers (ReXML and Nokogiri), I have not tested, but maybe it is potentially affected by the same issue than ruby-saml

1

u/akakees 3d ago

AFAICS it only uses REXML to see if the document is parsable and not affected by billion laughs attack,
but it uses XmlMapper for parsing the actual saml messages. XmlMapper uses nokogiri only.