CVE-2025-25291

The vulnerability results from differences in how XML is parsed by two libraries: ReXML and Nokogiri. The same XML input data can be interpreted by both libraries as completely different document structures. The attacker exploits this discrepancy to perform a Signature Wrapping attack — a technique involving manipulation of the SAML response structure in such a way that the digital signature is verified for a different fragment of the document than the one actually being processed. As a result, a malicious SAML response passes signature verification despite containing falsified identity data.

An attacker without any permissions can authenticate as any user, including an administrator, completely bypassing the SAML SSO signature verification mechanism. This results in full account takeover and unauthorized access to protected resources.

ruby-saml should be updated to version 1.12.4 or 1.18.0, which eliminate the vulnerability. For omniauth-saml and NetApp StorageGRID, patches available from the vendor should be applied according to references. As a temporary workaround, enforcing a uniform XML parser throughout the SAML processing chain should be considered.

The ruby-saml library in versions earlier than 1.12.4 and earlier than 1.18.0. The vulnerability also affects products using this library, including omniauth-saml and NetApp StorageGRID.