GHSA-754f-8gm6-c4r2 Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

• RubyGems ruby-saml: >= 1.13.0, < 1.18.0 → fixed in 1.18.0 • RubyGems ruby-saml: < 1.12.4 → fixed in 1.12.4

Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. Impact This issue may lead to authentication bypass.