GitHub Exposes Critical ruby-saml Flaw Threatening User Account Security

Summary:

• GitHub found critical vulnerabilities in the ruby-saml library that can allow account takeover.
• The flaws, CVE-2025-25291 and CVE-2025-25292, let an attacker bypass SAML authentication.
• GitHub Security Lab worked with the ruby-saml maintainers to fix the issue.
• Many applications rely on ruby-saml for single sign-on.
• Fixed versions are 1.18.0 and 1.12.4.

Introduction: A Wake-Up Call for Security

In March 2025, GitHub disclosed two critical vulnerabilities in ruby-saml, a widely used Ruby library for SAML single sign-on. The flaws, tracked as CVE-2025-25291 and CVE-2025-25292, can let an attacker log in as another user. Any application that uses the library for authentication was at risk until it updated.

Understanding the Vulnerability

SAML is how many companies handle single sign-on. ruby-saml checks the signed messages that tell an application who a user is. These bugs broke that check.

The Technical Breakdown

The root cause is a parser differential. ruby-saml used two different XML parsers, REXML and also Nokogiri, and the two could read the same document differently. An attacker holding one valid signed SAML document from the identity provider could craft a response that one parser verified while the other read a different identity, which is a classic signature wrapping attack. The result is account takeover.

Response from the Cybersecurity Community

GitHub Security Lab researcher Peter Stöckli found the issue while reviewing ruby-saml. GitHub worked with the library’s maintainers on a fix, an example of coordinated disclosure working as intended.

Patching and Prevention

The maintainers released ruby-saml 1.18.0 and 1.12.4 with the fixes. Developers were urged to update right away. Libraries that depend on ruby-saml, such as omniauth-saml, also needed updates. Fast patching matters here, since attackers move quickly once details are public.

Impact on Developers and Businesses

The impact reaches beyond single users. Developers and companies that rely on ruby-saml for authentication had to check their dependencies. SAML libraries are a recurring source of serious bugs, so the lesson is to track them closely.

Advisory and Future Considerations

GitHub and the ruby-saml maintainers published advisories to help developers secure their systems. The episode shows why continuous monitoring and regular updates are worth the effort.

The Bigger Picture

Finding vulnerabilities like these before attackers do is the goal. Here, it worked.

The Road Ahead

Developers should adopt a security-first mindset. Track your dependencies.

Conclusion: Reflecting on Cybersecurity Preparedness

The ruby-saml flaws are a useful lesson in preparedness. They show the risks hidden in common dependencies, and the value of coordinated disclosure. Keeping authentication libraries patched protects millions of users.

Shining a light on bugs like this makes the software everyone uses a little safer.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.