{"action":"Upgrade ruby-saml to 1.12.3 or later.","affected":[{"fixed":"1.12.3","introduced":"0"},{"fixed":"1.17.0","introduced":"1.13.0"}],"component":"ruby-saml","cve_ids":["CVE-2024-45409"],"ecosystem":"RubyGems","epss":0.10684,"exploited":false,"fixed_versions":["1.12.3","1.17.0"],"ghsa_id":"GHSA-jw9c-mfg7-9rx2","id":"tcs_01M5KEM1SPGAKNH3DNK6J49EKY","modified_at":"2026-08-07T08:11:51.793800677Z","published_at":"2024-09-10T19:42:03Z","references":["https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2","https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2","https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq","https://nvd.nist.gov/vuln/detail/CVE-2024-45409","https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd","https://github.com/SAML-Toolkits/ruby-saml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-jw9c-mfg7-9rx2","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2"}],"summary":"SAML authentication bypass via Incorrect XPath selector"}