CVE-2025-25291: Ruby Saml Rexml Xpath On Raw Document With Signed Element Idcve-2025-25291-ruby-saml-rexml-xpath-on-raw-document-with-signed-element-id
SAML signature-validation pipeline re-queries the raw XML document with REXML::XPath using `signed_element_id` as the `@ID` lookup variable to fetch downstream identity content (NameID, Attributes, Subject, etc.). The cryptographic signature was verified by Nokogiri on a (potentially) different document tree; trusting REXML's ID-based lookup on the raw docum
