omniauth saml vulnerabilities and fixes

Recent CVEs affecting omniauth saml, with upgrade or downgrade steps. 4 tracked.

Also searched as: omniauthsaml.

omniauth saml has 4 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-03-12. Highest priority: CVE-2025-25292 (score 72/100).

• CVE-2025-25293 HIGH 7.5 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
• CVE-2025-25292 CRITICAL 9.8 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
• CVE-2025-25291 CRITICAL 9.8 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
• CVE-2024-45409 CRITICAL 10.0 UPGRADE UPGRADE The Ruby SAML library is for implementing the client side of a SAML authorization

FAQ

How do I fix omniauth saml vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is omniauth saml being exploited right now?

None of the tracked omniauth saml CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which omniauth saml CVE should I patch first?

CVE-2025-25292 currently ranks highest (72/100): ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.

RSS feed for omniauth saml · ← Back to latest CVEs