CVE-2024-45409
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
CVE-2024-45409- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-04
EUVDEUVD-2024-2828
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
EUVD-2024-2828- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-jw9c-mfg7-9rx2
SAML authentication bypass via Incorrect XPath selector
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.
This vulnerability was reported by ahacker1 of SecureSAML ([email protected])
- Record
GHSA-jw9c-mfg7-9rx2- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
CVE-2024-45409- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-04
OSV
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
CVE-2024-45409- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2024-45409
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
DEBIAN-CVE-2024-45409- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
Show 4 moreShow less
OSVGHSA-jw9c-mfg7-9rx2
SAML authentication bypass via Incorrect XPath selector
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.
This vulnerability was reported by ahacker1 of SecureSAML ([email protected])
- Record
GHSA-jw9c-mfg7-9rx2- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-45409
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
UBUNTU-CVE-2024-45409- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBIT-gitlab-2024-45409 No score
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Record
BIT-gitlab-2024-45409- Updated
- 2026-11-02
OSVUSN-7309-1 No score
Ruby SAML vulnerabilities
It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697)
It was discovered that Ruby SAML incorrectly utilized the results of XML DOM traversal and canonicalization APIs. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11428)
It was discovered that Ruby SAML did not properly verify the signature of the SAML Response, allowing multiple elements with the same ID. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. (CVE-2024-45409)
- Record
USN-7309-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ruby-samlRubyGems |
before 1.12.3 | 1.12.3 |
ruby-samlRubyGems |
1.13.0 up to 1.17.0 | 1.17.0 |
gitlabBitnami |
before 16.11.10, 17.0.0 up to 17.0.8, 17.1.0 up to 17.1.8, 17.2.0 up to 17.2.7, 17.3.0 up to 17.3.3 | 16.11.1017.0.817.1.817.2.717.3.3 |
ruby-samlDebian:12 |
before 1.13.0-1+deb12u1, plus listed versions 1.13.0-1 |
1.13.0-1+deb12u1 |
ruby-samlDebian:11 |
before 1.11.0-1+deb11u1, plus listed versions 1.11.0-1 |
1.11.0-1+deb11u1 |
ruby-samlRubyGems |
before 1.12.3, plus listed versions 0.0.50.0.60.0.70.0.80.2.1 Show 45 moreShow less0.2.20.2.30.3.00.3.10.3.20.3.30.3.40.4.00.4.10.4.20.4.30.4.40.4.50.4.60.4.70.5.00.5.10.5.20.5.30.6.00.7.00.7.10.7.20.7.30.8.00.8.10.8.100.8.110.8.120.8.130.8.140.8.150.8.160.8.170.8.180.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.90.90.9.1 |
1.12.3 |
ruby-samlRubyGems |
1.13.0 up to 1.17.0, plus listed versions 1.14.01.15.01.16.0 |
1.17.0 |
ruby-samlUbuntu:Pro:16.04:LTS |
before 1.1.2-1ubuntu1+esm1, plus listed versions 0.9.2-11.0.0-11.1.2-1ubuntu1 |
1.1.2-1ubuntu1+esm1 |
ruby-samlUbuntu:Pro:18.04:LTS |
before 1.7.2-1ubuntu0.1~esm1, plus listed versions 1.4.1-11.7.2-1 |
1.7.2-1ubuntu0.1~esm1 |
ruby-samlUbuntu:20.04:LTS |
before 1.11.0-1ubuntu0.1, plus listed versions 1.7.2-11.11.0-1 |
1.11.0-1ubuntu0.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-samlUbuntu:22.04:LTS |
before 1.13.0-1ubuntu0.1, plus listed versions 1.11.0-11.13.0-1 |
1.13.0-1ubuntu0.1 |
ruby-samlUbuntu:24.04:LTS |
before 1.15.0-1ubuntu0.24.04.1, plus listed versions 1.15.0-1 |
1.15.0-1ubuntu0.24.04.1 |
ruby-samlUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 1.1.2-1ubuntu1+esm1, plus listed versions 0.9.2-11.0.0-11.1.2-1ubuntu1 |
1.1.2-1ubuntu1+esm1 |
ruby-samlUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 1.7.2-1ubuntu0.1~esm1, plus listed versions 1.4.1-11.7.2-1 |
1.7.2-1ubuntu0.1~esm1 |
ruby-samlUbuntu:20.04:LTS From an advisory covering 3 CVEs |
before 1.11.0-1ubuntu0.1, plus listed versions 1.7.2-11.11.0-1 |
1.11.0-1ubuntu0.1 |
ruby-samlUbuntu:22.04:LTS From an advisory covering 3 CVEs |
before 1.13.0-1ubuntu0.1, plus listed versions 1.11.0-11.13.0-1 |
1.13.0-1ubuntu0.1 |
ruby-samlUbuntu:24.04:LTS From an advisory covering 3 CVEs |
before 1.15.0-1ubuntu0.24.04.1, plus listed versions 1.15.0-1 |
1.15.0-1ubuntu0.24.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | synacktiv/CVE-2024-45409 | 2024-10-07 |
| PoC in GitHub | barkotenicholas/CVE-2024-45409 | 2026-10-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| exploits, facts | CVE List, EUVD | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45409 is a critical vulnerability (CVSS 10.0) in Omniauth Saml, published September 10, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.7%, the 95th percentile. Fixed in ruby-saml 1.12.3.
References
github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks
news.ycombinator.com/item?id=41586031
Show 16 moreShow less
security.netapp.com/advisory/ntap-20240926-0008
lists.debian.org/debian-lts-announce/2024/11/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2024-45409
security-tracker.debian.org/tracker/CVE-2024-45409
ubuntu.com/security/CVE-2024-45409
cve.org/CVERecord?id=CVE-2024-45409
Left out here: 30 versions. The JSON record has them.