A critical authentication bypass vulnerability exists in ruby-saml due to differences in XML parsing between ReXML and Nokogiri. This parser differential allows attackers to perform a Signature Wrapping attack, potentially bypassing authentication mechanisms. The vulnerability affects ruby-saml versions prior to 1.12.4 and versions from 1.13.0 up to but not including 1.18.0. Fixed versions 1.12.4 and 1.18.0 address this issue.