Onelogin

12 CVEs across 4 Onelogin products. Browse Onelogin vulnerabilities, severities, and proof-of-concept exploits.

Onelogin products with known CVEs

ProductCVEs
Ruby-Saml9
Active Directory Connector1
Onelogin Saml Sso1
Pythonsaml1
Onelogin CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-66568Critical9.12025-12-09The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through…
CVE-2025-66567Critical9.12025-12-09The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypa…
CVE-2025-52925Medium5.02025-07-02In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.
CVE-2025-25293High7.52025-03-12ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to re…
CVE-2025-25292Critical9.82025-03-12ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior…
CVE-2025-25291Critical9.82025-03-12ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior…
CVE-2024-45409Critical10.02024-09-10The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signa…
CVE-2015-20108Critical9.82023-05-27xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
CVE-2016-10928High7.52019-08-22The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
CVE-2017-11428High7.72019-04-17OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be a…
CVE-2017-11427High7.72019-04-17OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be…
CVE-2016-5697High7.52017-01-23Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.