Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2024-45409

critical

The Ruby SAML library is for implementing the client side of a SAML authorization.

Vendor / product: Onelogin — ruby-saml

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in

CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2024-09-10 19:15
Modified: 2026-11-04 00:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-04 00:25 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

onelogin / ruby-saml <1.12.3, ≥1.13.0 <1.17.0
omniauth / omniauth_saml ≤1.10.3, 2.0.0, 2.1.0
gitlab / gitlab <16.11.10, ≥17.0.0 <17.0.8, ≥17.1.0 <17.1.8, ≥17.2.0 <17.2.7, ≥17.3.0 <17.3.3

Weakness classification (CWE)

CWE-347

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
Vendor advisory: https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
Patch / mitigation: https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae
Patch / mitigation: https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7

References

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 00:25 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2025-66568CVE-2025-66567