CVE-2025-25292: 
Ruby vulnerability analysis and mitigation

CVE-2025-25292 is an authentication bypass vulnerability discovered in ruby-saml prior to versions 1.12.4 and 1.18.0. The vulnerability exists due to a parser differential where ReXML and Nokogiri parse XML differently, causing the parsers to generate entirely different document structures from the same XML input. This allows an attacker to execute a Signature Wrapping attack (GitHub Advisory, GitHub Blog).

The vulnerability stems from ruby-saml using two different XML parsers (REXML and Nokogiri) during signature verification. The discrepancy between how these parsers handle XML documents enables attackers to manipulate the SAML response structure. When validating signatures, REXML is used to extract the signature element while Nokogiri is used for canonicalization, creating a disconnect between verification of the hash and verification of the signature (PortSwigger Research).

Successful exploitation allows attackers who possess a single valid signature created with the key used to validate SAML responses or assertions to construct SAML assertions for any user, effectively enabling authentication bypass and account takeover attacks. The vulnerability has been found to affect major platforms like GitLab that use the ruby-saml library for SAML SSO authentication (Hacker News, GitLab Release).

The vulnerability has been patched in ruby-saml versions 1.12.4 and 1.18.0. Organizations using affected versions should update immediately. For those unable to update immediately, temporary mitigations include enabling two-factor authentication for all user accounts, disabling SAML two-factor bypass options, and requiring admin approval for automatically created new users (GitLab Release).

The security community has emphasized the severity of this vulnerability, with experts highlighting the inherent risks in XML-based security protocols. GitHub's security team discovered the vulnerability while evaluating ruby-saml for potential use, leading to coordinated disclosure and patching across affected vendors (GitHub Blog).