Onelogin Ruby-saml vulnerabilities

• onelogin ruby-saml ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation CVE-2025-66568 Fix available 9.3 CriticalDecember 8, 2025
• onelogin ruby-saml ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVE-2025-66567 Fix available 9.3 CriticalDecember 8, 2025
• omniauth saml, onelogin ruby-saml, netapp storagegrid +2 more Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVE-2025-25292 Fix available EPSS 65.1% 9.3 CriticalMarch 12, 2025
• omniauth saml, onelogin ruby-saml, netapp storagegrid +2 more ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVE-2025-25291 Fix available EPSS 21.0% 9.3 CriticalMarch 12, 2025
• omniauth saml, onelogin ruby-saml +1 more ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses CVE-2025-25293 Fix available 7.7 HighMarch 12, 2025
• omniauth saml, onelogin ruby-saml, gitlab +1 more +3 more The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVE-2024-45409 Public exploitFix available EPSS 10.7% 10.0 CriticalSeptember 10, 2024
• onelogin ruby-saml ruby-saml vulnerable to XPath injection CVE-2015-20108 Fix available 9.8 CriticalMay 27, 2023
• onelogin ruby-saml Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal CVE-2017-11428 Fix available 7.7 HighApril 17, 2019
• onelogin ruby-saml Ruby-saml allows attackers to perform XML signature wrapping attacks CVE-2016-5697 Fix available 7.5 HighJanuary 23, 2017