Critical Authentication Bypass in ruby-saml

Researchers at GitHub Security Lab discovered two critical authentication bypass vulnerabilities (CVE-2025-25291 and CVE-2025-25292) in the ruby-saml library. Attackers can use a single valid signature to forge SAML assertions, allowing account takeover by logging in as any user. The vulnerability stems from ruby-saml's use of two different XML parsers (REXML and Nokogiri), creating a parser differential exploited by attackers. Version 1.18.0 fixes the vulnerability; all users are urged to update immediately.