-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| omniauth-saml | rubygems | >= 2.0.0, < 2.1.2 | 2.1.2 |
| omniauth-saml | rubygems | < 1.10.5 | 1.10.5 |
| omniauth-saml | rubygems | >= 2.2.0, < 2.2.1 | 2.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability originates from the ruby-saml dependency (<=1.12.0 and 1.13.0-1.16.0), which improperly handles XML signature verification due to an incorrect XPath selector. omniauth-saml itself does not contain the vulnerable code but becomes vulnerable by depending on unpatched ruby-saml versions. The patches for omniauth-saml (1.10.5, 2.1.2, 2.2.1) only update the ruby-saml dependency to a fixed version (>=1.17.0). No functions in omniauth-saml's codebase directly implement the flawed cryptographic verification logic; the vulnerability is inherited via the dependency chain.