PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5697 Onelogin CVE debrief

CVE-2016-5697 affects OneLogin ruby-saml and is described as an XML signature wrapping issue in versions before 1.3.0. NVD’s CPE data currently marks ruby-saml through 1.2.0 as vulnerable. The record carries a CVSS 3.0 base score of 7.5 (HIGH) with network access, no privileges, and high integrity impact, which makes this a serious issue for any service relying on the library for SAML authentication.

Vendor
Onelogin
Product
CVE-2016-5697
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Identity and access management teams, SSO/SAML implementers, application security teams, and operators of services that use OneLogin ruby-saml for authentication or assertion handling.

Technical summary

The official record describes an XML signature wrapping vulnerability in ruby-saml, categorized as CWE-91. In practical terms, a flaw in how signed XML is processed can let attackers manipulate authentication material in SAML-related workflows. The supplied NVD data rates the issue as remotely reachable, low complexity, no privileges required, no user interaction, and high integrity impact.

Defensive priority

High priority for any environment using vulnerable ruby-saml versions in SAML login flows, because the weakness can undermine authentication integrity without requiring credentials or user interaction.

Recommended defensive actions

  • Upgrade OneLogin ruby-saml to version 1.3.0 or later, since the advisory describes versions before 1.3.0 as affected.
  • Inventory applications and services that depend on ruby-saml so all affected deployments are identified, including indirect dependencies.
  • Review SAML signature validation handling after upgrade and confirm the application rejects malformed or wrapped XML structures.
  • Validate the fix in staging before production rollout and monitor authentication-related logs for unusual assertion-processing errors or failures.

Evidence notes

This debrief is grounded in the official CVE/NVD record and the linked OSS Security mailing-list reference. The supplied description states that ruby-saml before 1.3.0 allows XML signature wrapping attacks via unspecified vectors. NVD’s CPE criteria mark cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* as vulnerable through 1.2.0. NVD also assigns CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N and CWE-91. The source corpus does not provide exploit details beyond the signature-wrapping characterization.

Official resources

The CVE record was published on 2017-01-23 and modified on 2026-05-13 per the supplied official metadata. This debrief uses those official record dates for context and does not infer the original issue discovery date.