CVE-2024-45409ruby-saml 2024 auth bypass (ahacker1), still in the blast radius
What broke
CVE-2024-45409 is the 2024 ruby-saml authentication bypass widely discussed as "ahacker1." A crafted SAML response let an attacker authenticate as any user. CVSS 10.0. It was patched in 2024, then the 2025 series (CVE-2025-25291 and friends) showed the same library still had wrapping paths.
Why it matters
We keep this brief in a 2025-2026 catalog because defenders still find the old gem in lockfiles, vendor appliances, and internal tools that nobody has rebuilt since 2023. The 2025 CVEs are easier to explain once you have seen this one.
What to do
- If ruby-saml is older than the 2024 patched line, you are not in the 2025 conversation yet. Upgrade to 1.18.1 in one step.
- Search container images and vendor appliances, not only application repos. This library hides in GitLab, ticketing tools, and homegrown SSO gateways.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
Related identity CVEs
- CVE-2025-54572ruby-saml auth bypass, incomplete fix of CVE-2025-25292
- CVE-2025-25292ruby-saml companion signature-wrapping bypass
- CVE-2025-25291ruby-saml parser differential enables signature wrapping
- CVE-2024-8698Keycloak SAML signature validation bypass
- CVE-2024-4985GitHub Enterprise Server SAML encrypted-assertion bypass
Related on Start with Identity
- CVEruby-saml auth bypass, incomplete fix of CVE-2025-25292
The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you
- CVEruby-saml bypass after 1.12.4, PortSwigger Fragile Lock
Disclosed 8 December 2025 with CVE-2025-66568. ruby-saml below 1.18.0, including the earlier patched 1.12.4 line, still allowed SAML assertion forgery. Fixed in
- CVEruby-saml companion signature-wrapping bypass
The pair to CVE-2025-25291. A second signature-wrapping path in ruby-saml lets an attacker forge assertions and impersonate any user. The March 2025 patch was l
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.