GHSA-4vc4-m8qh-g8jm Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

• RubyGems ruby-saml: < 1.12.4 → fixed in 1.12.4 • RubyGems ruby-saml: >= 1.13.0, < 1.18.0 → fixed in 1.18.0

Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. Impact This issue may lead to authentication bypass.