Package Instance

Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely
different document structures from the same XML input. That allows an
attacker to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.

Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.

XXE vulnerability
The gem is vulnerable to external entity expansion attacks.

Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
### Summary
ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses.

Ruby-saml uses zlib to decompress SAML responses in case they're compressed.
It is possible to bypass the message size check with a compressed assertion
since the message size is checked before inflation and not after.

### Impact
This issue may lead to remote Denial of Service (DoS).

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely
different document structures from the same XML input. That allows an attacker
to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.

XPath Injection Vulnerability
The gem is vulnerable to XPath injection on xml_security.rb. The lack of prepared statements allows for command injection, leading to arbitrary code execution.

ruby-saml vulnerable to XPath injection
`xml_security.rb` in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.

Arbitrary code execution
The gem contains a flaw that is triggered as the URI value of a SAML response is not properly sanitized through a prepared statement. This may allow a remote attacker to execute arbitrary shell commands on the host machine.

Authentication bypass via incorrect DOM traversal and canonicalization
Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider

SAML authentication bypass via Incorrect XPath selector
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response.
An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML
Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within
the vulnerable system.