Vulnerability details

CVE-2025-66567

SAML-Toolkits ruby-saml

ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

CVSS 4.0

9.3Critical

Official description

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
SAML-Toolkits	ruby-saml	< 1.18.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3 x_refsource_CONFIRM
https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97 x_refsource_MISC
https://github.com/advisories/GHSA-754f-8gm6-c4r2 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-12-09
Last updated: 2025-12-09
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.41%

Probability of exploitation in 30 days

36.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-347
Improper Verification of Cryptographic Signature