# ruby-saml (RubyGems) vulnerabilities

Source: https://junglewise.ai/threats/technologies/rubygems-ruby-saml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/rubygems-ruby-saml.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 10 vulnerabilities in ruby-saml (RubyGems): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2025-66568, was published on 9 December 2025.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 10 (2 critical, 0 exploited in the wild)

## About ruby-saml (RubyGems)

Ruby gem implementing SAML authentication protocol for single sign-on in web applications.

## Latest ruby-saml (RubyGems) vulnerabilities

- [CVE-2025-66568: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation](https://junglewise.ai/threats/cve-2025-66568-ruby-saml-allows-a-libxml2-canonicalization-error-to-bypass) (critical, CVSS 9.1, published 9 Dec 2025)
- [CVE-2025-66567: Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)](https://junglewise.ai/threats/cve-2025-66567-ruby-saml-has-a-saml-authentication-bypass-due-to-namespace) (critical, CVSS 9.1, published 9 Dec 2025)
- [CVE-2025-54572: Ruby SAML DOS vulnerability with large SAML response](https://junglewise.ai/threats/cve-2025-54572-ruby-saml-dos-vulnerability-with-large-saml-response) (medium, CVSS 4, published 30 Jul 2025)
- [CVE-2025-25292: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)](https://junglewise.ai/threats/cve-2025-25292-ruby-saml-allows-a-saml-authentication-bypass-due-to-namespace) (low, CVSS 3.1, published 12 Mar 2025)
- [CVE-2025-25291: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)](https://junglewise.ai/threats/cve-2025-25291-ruby-saml-allows-a-saml-authentication-bypass-due-to-doctype) (low, CVSS 3.1, published 12 Mar 2025)
- [CVE-2025-25293: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses](https://junglewise.ai/threats/cve-2025-25293-ruby-saml-allows-remote-denial-of-service-dos-with-compressed) (low, CVSS 3.1, published 12 Mar 2025)
- [CVE-2024-45409: SAML authentication bypass via Incorrect XPath selector](https://junglewise.ai/threats/cve-2024-45409-saml-authentication-bypass-via-incorrect-xpath-selector) (low, CVSS 3.1, published 10 Sep 2024)
- [CVE-2015-20108: ruby-saml vulnerable to XPath injection](https://junglewise.ai/threats/cve-2015-20108-ruby-saml-vulnerable-to-xpath-injection) (low, CVSS 3.1, published 27 May 2023)
- [CVE-2017-11428: Ruby-SAML Improper Authentication vulnerability](https://junglewise.ai/threats/cve-2017-11428-ruby-saml-improper-authentication-vulnerability) (low, CVSS 3, published 5 Jul 2019)
- [CVE-2016-5697: OneLogin ruby-saml XML signature wrapping attack](https://junglewise.ai/threats/cve-2016-5697-onelogin-ruby-saml-xml-signature-wrapping-attack) (high, CVSS 7.5, published 23 Jan 2017)

## Most severe ruby-saml (RubyGems) vulnerabilities

- [CVE-2025-66567: Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)](https://junglewise.ai/threats/cve-2025-66567-ruby-saml-has-a-saml-authentication-bypass-due-to-namespace) (critical, CVSS 9.1, published 9 Dec 2025)
- [CVE-2025-66568: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation](https://junglewise.ai/threats/cve-2025-66568-ruby-saml-allows-a-libxml2-canonicalization-error-to-bypass) (critical, CVSS 9.1, published 9 Dec 2025)
- [CVE-2016-5697: OneLogin ruby-saml XML signature wrapping attack](https://junglewise.ai/threats/cve-2016-5697-onelogin-ruby-saml-xml-signature-wrapping-attack) (high, CVSS 7.5, published 23 Jan 2017)
- [CVE-2025-54572: Ruby SAML DOS vulnerability with large SAML response](https://junglewise.ai/threats/cve-2025-54572-ruby-saml-dos-vulnerability-with-large-saml-response) (medium, CVSS 4, published 30 Jul 2025)
- [CVE-2025-25292: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)](https://junglewise.ai/threats/cve-2025-25292-ruby-saml-allows-a-saml-authentication-bypass-due-to-namespace) (low, CVSS 3.1, published 12 Mar 2025)
- [CVE-2025-25291: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)](https://junglewise.ai/threats/cve-2025-25291-ruby-saml-allows-a-saml-authentication-bypass-due-to-doctype) (low, CVSS 3.1, published 12 Mar 2025)
- [CVE-2024-45409: SAML authentication bypass via Incorrect XPath selector](https://junglewise.ai/threats/cve-2024-45409-saml-authentication-bypass-via-incorrect-xpath-selector) (low, CVSS 3.1, published 10 Sep 2024)
- [CVE-2025-25293: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses](https://junglewise.ai/threats/cve-2025-25293-ruby-saml-allows-remote-denial-of-service-dos-with-compressed) (low, CVSS 3.1, published 12 Mar 2025)
- [CVE-2015-20108: ruby-saml vulnerable to XPath injection](https://junglewise.ai/threats/cve-2015-20108-ruby-saml-vulnerable-to-xpath-injection) (low, CVSS 3.1, published 27 May 2023)
- [CVE-2017-11428: Ruby-SAML Improper Authentication vulnerability](https://junglewise.ai/threats/cve-2017-11428-ruby-saml-improper-authentication-vulnerability) (low, CVSS 3, published 5 Jul 2019)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other RubyGems technologies

- [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack): 77 vulnerabilities
- [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri): 69 vulnerabilities
- [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack): 55 vulnerabilities
- [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord): 26 vulnerabilities
- [rubygems-update (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-update): 25 vulnerabilities
- [puppet (RubyGems)](https://junglewise.ai/threats/technologies/puppet): 23 vulnerabilities
- [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport): 20 vulnerabilities
- [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview): 19 vulnerabilities
- [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage): 19 vulnerabilities
- [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms): 19 vulnerabilities
- [rails-html-sanitizer (RubyGems)](https://junglewise.ai/threats/technologies/rails-html-sanitizer): 18 vulnerabilities
- [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah): 17 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ruby-saml (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/rubygems-ruby-saml, 13 November 2026.