Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

Ruby SAML has a flaw where different XML parsers handle namespaces differently, allowing attackers to forge valid authentication tokens and bypass login protections. This is a critical vulnerability that can give unauthorized access to protected systems.

The vulnerability stems from parser differential behavior between ReXML and Nokogiri in namespace handling, enabling Signature Wrapping attacks (CWE-347) where attackers craft malicious SAML responses that validate against one parser but execute differently in another. No special privileges required; the attack vector is network-based and affects the SAML authentication flow prior to versions 1.12.4 and 1.18.0.