CVE-2025-54572ruby-saml auth bypass, incomplete fix of CVE-2025-25292
What broke
The March 2025 ruby-saml patches for CVE-2025-25291 and CVE-2025-25292 left a parser-differential path open. CVE-2025-54572 is that leftover: an attacker can still construct a SAML response that verifies on one XML tree and authenticates as a different user on the other.
Why it matters
Incomplete fixes are how signature-wrapping stays in production for a year. Teams that closed the March ticket and moved on were still impersonable. This is also why "we patched ruby-saml in Q1" is not an answer an auditor should accept in late 2025.
What to do
- Confirm the running version is 1.18.1 or later, not "we patched in March."
- Re-test ACS handling with a known wrapping fixture after every library bump. Regression tests are how you catch the next incomplete fix, including CVE-2025-66567.
- Rotate signing keys if the SP was reachable while on the incomplete patch.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
Related identity CVEs
Related on Start with Identity
- CVEruby-saml 2024 auth bypass (ahacker1), still in the blast radius
The original 2024 ruby-saml authentication bypass (CVSS 10.0). It is outside the last twelve months, but every 2025 ruby-saml CVE is an incomplete-fix descendan
- CVEruby-saml denial of service via compressed SAML messages
A compressed SAML message can be inflated into a resource-exhaustion hit against ruby-saml. Not an impersonation bug, but it sits in the same March 2025 patch t
- CVEruby-saml second Fragile Lock bypass
Companion to CVE-2025-66567. Another SAML bypass in ruby-saml below 1.18.0, including 1.12.4. Same December 2025 disclosure, same 1.18.1 fix.
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.