PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5697 Onelogin CVE debrief

CVE-2016-5697 affects OneLogin ruby-saml and is described as an XML signature wrapping issue in versions before 1.3.0. NVD’s CPE data currently marks ruby-saml through 1.2.0 as vulnerable. The record carries a CVSS 3.0 base score of 7.5 (HIGH) with network access, no privileges, and high integrity impact, which makes this a serious issue for any service relying on the library for SAML authentication.

Vendor
Onelogin
Product
Ruby-Saml
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Identity and access management teams, SSO/SAML implementers, application security teams, and operators of services that use OneLogin ruby-saml for authentication or assertion handling.

Technical summary

The official record describes an XML signature wrapping vulnerability in ruby-saml, categorized as CWE-91. In practical terms, a flaw in how signed XML is processed can let attackers manipulate authentication material in SAML-related workflows. The supplied NVD data rates the issue as remotely reachable, low complexity, no privileges required, no user interaction, and high integrity impact.

Defensive priority

High priority for any environment using vulnerable ruby-saml versions in SAML login flows, because the weakness can undermine authentication integrity without requiring credentials or user interaction.

Recommended defensive actions

  • Upgrade OneLogin ruby-saml to version 1.3.0 or later, since the advisory describes versions before 1.3.0 as affected.
  • Inventory applications and services that depend on ruby-saml so all affected deployments are identified, including indirect dependencies.
  • Review SAML signature validation handling after upgrade and confirm the application rejects malformed or wrapped XML structures.
  • Validate the fix in staging before production rollout and monitor authentication-related logs for unusual assertion-processing errors or failures.

Evidence notes

This debrief is grounded in the official CVE/NVD record and the linked OSS Security mailing-list reference. The supplied description states that ruby-saml before 1.3.0 allows XML signature wrapping attacks via unspecified vectors. NVD’s CPE criteria mark cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* as vulnerable through 1.2.0. NVD also assigns CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N and CWE-91. The source corpus does not provide exploit details beyond the signature-wrapping characterization.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5697 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5697

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5697 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5697

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.