GHSA-cvp8-5r8g-fhvq: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

The vulnerability originates from the ruby-saml dependency (<=1.12.0 and 1.13.0-1.16.0), which improperly handles XML signature verification due to an incorrect XPath selector. omniauth-saml itself does not contain the vulnerable code but becomes vulnerable by depending on unpatched ruby-saml versions. The patches for omniauth-saml (1.10.5, 2.1.2, 2.2.1) only update the ruby-saml dependency to a fixed version (>=1.17.0). No functions in omniauth-saml's codebase directly implement the flawed cryptographic verification logic; the vulnerability is inherited via the dependency chain.