A critical authentication bypass vulnerability exists in ruby-saml due to differences in XML parsing between ReXML and Nokogiri. This parser differential allows attackers to perform a Signature Wrapping attack, potentially bypassing authentication mechanisms. The vulnerability affects ruby-saml versions >=1.13.0 <1.18.0 and versions <1.12.4. Fixed versions 1.18.0 and 1.12.4 address this issue.