Onelogin Ruby-saml
9 CVEs affecting Onelogin Ruby-saml. Latest disclosed: 2025-12-09. Critical: 6, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45409 | Critical | 10.0 | 2024-09-10 | The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signa… |
CVE-2025-25292 | Critical | 9.8 | 2025-03-12 | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior… |
CVE-2025-25291 | Critical | 9.8 | 2025-03-12 | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior… |
CVE-2015-20108 | Critical | 9.8 | 2023-05-27 | xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used. |
CVE-2025-66568 | Critical | 9.1 | 2025-12-09 | The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through… |
CVE-2025-66567 | Critical | 9.1 | 2025-12-09 | The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypa… |
CVE-2017-11428 | High | 7.7 | 2019-04-17 | OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be a… |
CVE-2025-25293 | High | 7.5 | 2025-03-12 | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to re… |
CVE-2016-5697 | High | 7.5 | 2017-01-23 | Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors. |