The vulnerability arises because Nokogiri versions older than 1.19.1 do not verify the return value of xmlC14NExecute in their canonicalize method; if canonicalization fails, an empty string is returned instead of an exception. Attackers can exploit this flaw by supplying malformed XML to downstream SAML libraries that rely on Nokogiri for canonicalization, causing those libraries to accept an empty or otherwise invalid canonicalized XML as a valid signature. The likely attack vector is through network traffic that delivers XML payloads to an application that processes them with Nokogiri, such as REST endpoints or SOAP services; this inference follows from the stated impact of bypassing SAML signature verification.

Any application that incorporates the Nokogiri library to process XML—especially Ruby or Rails applications using SAML authentication—running a Nokogiri version prior to 1.19.1 is affected. This includes common frameworks, identity provider implementations, and service provider integrations that depend on Nokogiri for XML canonicalization.

The CVSS score of 6.9 classifies this vulnerability as moderate severity, reflecting its potential to undermine authentication mechanisms. The EPSS score is not available, indicating there is currently no published statistical data on exploitation likelihood; however, the description indicates that a remote attacker could trigger the flaw by delivering crafted XML to a vulnerable application. The vulnerability is not listed in the CISA KEV catalog, and no publicly disclosed exploitation code is known. Nonetheless, the ability to bypass signature verification directly threatens the integrity of SAML workflows, making the risk significant for any system that relies on signature validation for authentication.