GHSA-hw46-3hmr-x9xv
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue
GHSA-hw46-3hmr-x9xv is a vulnerability with no CVSS score yet in omniauth-saml, published March 12, 2025. No source lists public exploit code. Fixed in omniauth-saml 2.2.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.3omniauth-saml +5 more
Description
Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
Please upgrade the ruby-saml requirement to v1.18.0.
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
omniauth-samlRubyGems | 2.2.0 up to 2.2.3 | 2.2.3 |
omniauth-samlRubyGems | 2.0.0 up to 2.1.3 | 2.1.3 |
omniauth-samlRubyGems | before 1.10.6 | 1.10.6 |
omniauth-samlRubyGems | 2.2.0 up to 2.2.3, plus listed versions 2.2.12.2.2 | 2.2.3 |
omniauth-samlRubyGems | 2.0.0 up to 2.1.3, plus listed versions 2.1.02.1.12.1.2 | 2.1.3 |
omniauth-samlRubyGems | before 1.10.6, plus listed versions 0.9.00.9.10.9.21.0.01.1.0 Show 18 moreShow less1.10.01.10.11.10.21.10.31.10.41.10.51.2.01.3.01.3.11.4.01.4.11.4.21.5.01.6.01.7.01.8.01.8.11.9.0 | 1.10.6 |
What each source reports
GitHub AdvisoriesNo score
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue
Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
Please upgrade the ruby-saml requirement to v1.18.0.
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
- Record
GHSA-hw46-3hmr-x9xv- Weakness
- CWE-347
- Updated
- 2026-11-02
OSVNo score
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue
Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
Please upgrade the ruby-saml requirement to v1.18.0.
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
- Record
GHSA-hw46-3hmr-x9xv- Weakness
- CWE-347
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
rubygems.org/gems/omniauth-saml/versions/2.2.3