How many CVEs does OneLogin have?

OneLogin has 12 published CVE records since 2017, including 6 in the last two years.

How many OneLogin CVEs are in CISA KEV?

None of OneLogin's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which OneLogin products have the most CVEs?

The OneLogin products with the most published CVEs are Ruby-SAML, Active Directory Connector, onelogin saml sso, python-saml, PythonSAML.

What are the most common weakness types in OneLogin CVEs?

OneLogin's CVEs most often map to these CWE weakness types: CWE-347 (Improper Verification of Cryptographic Signature), CWE-287 (Improper Authentication), CWE-400 (Uncontrolled Resource Consumption), CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak')).

Are there public exploits for OneLogin vulnerabilities?

Yes — 2 of OneLogin's CVEs have a known public exploit.

How many critical OneLogin vulnerabilities are there?

OneLogin has 7 critical and 4 high-severity CVEs.

What is the average severity of OneLogin CVEs?

The average CVSS base score across OneLogin's scored CVEs is 8.6.

RadicalNotion.AI

Log in Start free

12 CVEs

OneLogin Vulnerabilities

Name: OneLogin vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for OneLogin.

12

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

2

Public exploits

PoC or exploit code

8.6

Avg CVSS

2017–2025

Overview

OneLogin has 12 published CVE records since 2017, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 8.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting OneLogin products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on OneLogin's vulnerability posture, as a share of its 12 published CVEs.

Average CVSS: 8.6
Critical / high: 92%
Actively exploited (KEV): 0%
Public exploit available: 17%
Patch available: 100%

Severity and exploitation

How the CVSS severity of OneLogin's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical7

High4

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of OneLogin's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2

2 of OneLogin's CVEs have a known public exploit available.

Most affected products

The OneLogin products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in OneLogin CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish OneLogin CVE records.

Disclosure activity by year

How many OneLogin CVEs were published each year.

2017

1

2019

3

2023

1

2024

1

2025

6

Latest OneLogin CVEs

The most recently disclosed vulnerabilities affecting OneLogin.

ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation
CWE-347
Critical · CVSS 9.3
EPSS 0.2%2025-12-09
ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
CWE-347
Critical · CVSS 9.3
EPSS 0.4%2025-12-09
Medium vulnerability · 2025-07-02
CWE-402
Medium · CVSS 5.0
EPSS 0.1%2025-07-02
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
CWE-347
Critical · CVSS 9.3
EPSS 65.1%2025-03-12
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
CWE-347
Critical · CVSS 9.3
EPSS 20.3%2025-03-12
ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
CWE-400
High · CVSS 7.7
EPSS 1.5%2025-03-12
Critical vulnerability · 2024-09-10
CWE-347
Critical · CVSS 9.9
EPSS 10.7%2024-09-10
Critical vulnerability · 2023-05-27
CWE-77
Critical · CVSS 9.8
EPSS 1.3%2023-05-27
High vulnerability · 2019-08-22
High · CVSS 7.5
EPSS 1.7%2019-08-22
Critical vulnerability · 2019-04-17
CWE-287
Critical · CVSS 9.8
EPSS 2.4%2019-04-17
High vulnerability · 2019-04-17
CWE-287
High · CVSS 8.3
EPSS 4.7%2019-04-17
High vulnerability · 2017-01-23
High · CVSS 7.5
EPSS 1.2%2017-01-23

Track new OneLogin CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor OneLogin CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,673 CVEs linux22,774 CVEs Google16,481 CVEs Apple15,095 CVEs Oracle12,708 CVEs Debian10,226 CVEs IBM8,839 CVEs Red Hat8,111 CVEs

Browse all vendors

Frequently asked questions

Common questions about OneLogin vulnerabilities.

How many CVEs does OneLogin have?: OneLogin has 12 published CVE records since 2017, including 6 in the last two years.
How many OneLogin CVEs are in CISA KEV?: None of OneLogin's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which OneLogin products have the most CVEs?: The OneLogin products with the most published CVEs are Ruby-SAML, Active Directory Connector, onelogin saml sso, python-saml, PythonSAML.
What are the most common weakness types in OneLogin CVEs?: OneLogin's CVEs most often map to these CWE weakness types: CWE-347 (Improper Verification of Cryptographic Signature), CWE-287 (Improper Authentication), CWE-400 (Uncontrolled Resource Consumption), CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak')).
Are there public exploits for OneLogin vulnerabilities?: Yes — 2 of OneLogin's CVEs have a known public exploit.
How many critical OneLogin vulnerabilities are there?: OneLogin has 7 critical and 4 high-severity CVEs.
What is the average severity of OneLogin CVEs?: The average CVSS base score across OneLogin's scored CVEs is 8.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track OneLogin vulnerabilities

Monitor new OneLogin vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing