CVE-2016-5697
Ruby-saml allows attackers to perform XML signature wrapping attacks
CVE-2016-5697 is a high vulnerability (CVSS 7.5) in Onelogin Ruby-saml, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in ruby-saml 1.3.0.
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
- Record
CVE-2016-5697- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
CVE List No score
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
- Record
CVE-2016-5697- Updated
- 2026-11-02
EUVDEUVD-2018-0357 No score
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
- Record
EUVD-2018-0357- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36p7-xjw8-h6f2
Ruby-saml allows attackers to perform XML signature wrapping attacks
ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion). ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack.
- Record
GHSA-36p7-xjw8-h6f2- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
OSV
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
- Record
CVE-2016-5697- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-5697
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
- Record
DEBIAN-CVE-2016-5697- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-36p7-xjw8-h6f2
Ruby-saml allows attackers to perform XML signature wrapping attacks
ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion). ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack.
- Record
GHSA-36p7-xjw8-h6f2- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-5697
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
- Record
UBUNTU-CVE-2016-5697- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUSN-7309-1 No score
Ruby SAML vulnerabilities
It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697)
It was discovered that Ruby SAML incorrectly utilized the results of XML DOM traversal and canonicalization APIs. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11428)
It was discovered that Ruby SAML did not properly verify the signature of the SAML Response, allowing multiple elements with the same ID. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. (CVE-2024-45409)
- Record
USN-7309-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ruby-samlRubyGems |
before 1.3.0 | 1.3.0 |
ruby-samlDebian:12 |
before 1.3.0-1 | 1.3.0-1 |
ruby-samlRubyGems |
before 1.3.0, plus listed versions 0.0.50.0.60.0.70.0.80.2.1 Show 45 moreShow less0.2.20.2.30.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.20.4.30.4.40.4.50.4.60.4.70.5.00.5.10.5.20.5.30.6.00.7.00.7.10.7.20.7.30.8.00.8.10.8.100.8.110.8.120.8.130.8.140.8.150.8.160.8.170.8.180.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.90.90.9.1 |
1.3.0 |
ruby-samlUbuntu:Pro:16.04:LTS |
before 1.1.2-1ubuntu1+esm1, plus listed versions 0.9.2-11.0.0-11.1.2-1ubuntu1 |
1.1.2-1ubuntu1+esm1 |
ruby-samlUbuntu:Pro:18.04:LTS |
before 1.7.2-1ubuntu0.1~esm1, plus listed versions 1.4.1-11.7.2-1 |
1.7.2-1ubuntu0.1~esm1 |
ruby-samlUbuntu:20.04:LTS |
before 1.11.0-1ubuntu0.1, plus listed versions 1.7.2-11.11.0-1 |
1.11.0-1ubuntu0.1 |
ruby-samlUbuntu:22.04:LTS |
before 1.13.0-1ubuntu0.1, plus listed versions 1.11.0-11.13.0-1 |
1.13.0-1ubuntu0.1 |
ruby-samlUbuntu:24.04:LTS |
before 1.15.0-1ubuntu0.24.04.1, plus listed versions 1.15.0-1 |
1.15.0-1ubuntu0.24.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2016/06/24/3
nvd.nist.gov/vuln/detail/CVE-2016-5697
github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995
security-tracker.debian.org/tracker/CVE-2016-5697
Left out here: 8 versions. The JSON record has them.