What’s Vulnerable › Vulnerabilities

CVE-2017-11428: Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-17 · updated 2026-06-17
• Weakness: CWE-287

Description

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Affected products

• SAML-Toolkits ruby-saml: through 1.6.0

References

• https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
• https://www.kb.cert.org/vuls/id/475445
• https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
• https://www.kb.cert.org/vuls/id/475445

Get alerted when CVE-2017-11428 or the next vulnerability affects your stack