What is CVE-2024-45409?

CVE-2024-45409 is a critical-severity vulnerability in GitLab, classified under Improper Verification of Cryptographic Signature. CVSS score: 10.0/10. Published 2024-09-10.

How severe is CVE-2024-45409?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Is CVE-2024-45409 known to be exploited?

11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in GitLab

CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Published 2024-09-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.107 (95.8th percentile), scored 2026-10-31.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.107 · newest: 0.107 · change: 0.000

Affected products

GitLab
Omniauth Saml — versions 2.0.0, 2.1.0
Onelogin Ruby-Saml
Saml-Toolkits Ruby-Saml — versions < 1.12.3, >= 1.13.0, < 1.17.0

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-45409?: CVE-2024-45409 is a critical-severity vulnerability in GitLab, classified under Improper Verification of Cryptographic Signature. CVSS score: 10.0/10. Published 2024-09-10.
How severe is CVE-2024-45409?: Critical severity. CVSS v3 base score is 10.0 out of 10.
Is CVE-2024-45409 known to be exploited?: 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.