FlagThis

Critical vulnerabilities in the ruby-saml library, tracked as CVE-2025-25291 and CVE-2025-25292, allow attackers to bypass authentication in applications using the library for Single Sign-On (SSO). These flaws stem from discrepancies in XML parsing between REXML and Nokogiri, potentially leading to account takeovers. An attacker possessing a valid signature from the targeted organization can craft SAML assertions to log in as any user.

The vulnerabilities were discovered during a security review by GitHub's Security Lab, prompting GitLab to release critical patches in versions 17.9.2, 17.8.5, and 17.7.7 for Community Edition and Enterprise Edition. Organizations are urged to upgrade to the latest ruby-saml version to mitigate the risk of authentication bypass and account hijacking. The ruby-saml library is used in various applications and products, including GitLab.

ImgSrc: blogger.googleu

References :

• www.scworld.com: Account hijacking possible with ruby-saml library bugs
• gbhackers.com: Critical ruby-saml Vulnerabilities Allow Attackers to Bypass Authentication
• bsky.app: GitHub's security team has discovered a combo of two bugs in the Ruby-SAML library that can be used to bypass authentication in apps that use the library.

Classification:

• HashTags: #ruby-saml #authentication #accounttakeover
• Company: GitHub
• Target: Web Applications
• Product: ruby-saml
• Feature: SSO bypass
• Malware: ruby-saml vulns
• Type: Vulnerability
• Severity: Critical