CVE-2025-25292

The vulnerability results from differences in XML parsing methods between ReXML and Nokogiri libraries (so-called parser differential). Both libraries can generate completely different document structures from identical input XML. An attacker exploits this discrepancy to perform a Signature Wrapping attack — a prepared XML document contains a valid digital signature for one structure, but when reparsed by the other library, modified content is read that was omitted during signature verification. As a result, signature verification succeeds for the malicious SAML assertion.

An attacker can effectively authenticate as any user in the system without knowledge of their credentials, leading to complete account takeover and unauthorized access to resources protected by SAML SSO.

Update ruby-saml to version 1.12.4 or 1.18.0, which contain patches eliminating the vulnerability. GitLab users should apply the update described in GitLab security advisory 17.9.2. The omniauth-saml libraries dependent on ruby-saml also require updates to versions based on patched releases.

ruby-saml in versions prior to 1.12.4 and 1.18.0, and the omniauth-saml library using vulnerable versions of ruby-saml