CVE-2017-11428 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

What is CVE-2017-11428?

CVE-2017-11428 is a high-severity authentication bypass vulnerability in OneLogin Ruby-SAML, published on 17 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Weakness: CWE-287

Which versions are affected by CVE-2017-11428?

2 open source packages ship an affected version, including ruby-saml. It affects 1 product.

Products include Onelogin Ruby-Saml.

How do I fix CVE-2017-11428?

Upgrade ruby-saml to 1.7.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-11428 being exploited?

There is no known exploitation of CVE-2017-11428 in the wild and no public exploit code.

Other vulnerabilities in OneLogin Ruby-SAML

• CVE-2015-20108 ruby-saml vulnerable to XPath injection Critical 9.8
• CVE-2025-66567 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) Critical 9.3
• CVE-2025-66568 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation Critical 9.3
• CVE-2016-5697 Ruby-saml allows attackers to perform XML signature wrapping attacks High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-11428, GHSA-x2fr-v8wf-8wwv, UBUNTU-CVE-2017-11428.