BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-10

Assigner: GitHub, Inc.

Description

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-09

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-12-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66567

Affected Vendors & Products

Vendor	Product	Version / Range
ruby-saml	ruby-saml	1.12.4
ruby-saml	ruby-saml	1.18.0
onelogin	ruby-saml	to 1.18.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the ruby-saml library versions up to 1.12.4 and is an authentication bypass caused by an incomplete fix for a previous vulnerability (CVE-2025-25292). The issue arises because the XML parsers ReXML and Nokogiri interpret the same XML input differently, resulting in different document structures. This discrepancy allows an attacker to perform a Signature Wrapping attack, bypassing authentication checks. The vulnerability is fixed in version 1.18.0 of ruby-saml.

Impact Analysis

This vulnerability can allow an attacker to bypass authentication mechanisms in applications using vulnerable versions of ruby-saml. By exploiting the Signature Wrapping attack, an attacker could gain unauthorized access to systems or data that rely on ruby-saml for SAML authorization, potentially leading to data breaches or unauthorized actions within the affected system.

Mitigation Strategies

Upgrade the ruby-saml library to version 1.18.0 or later, as this version contains the fix for the authentication bypass vulnerability caused by the incomplete fix in earlier versions.

Hi! I’m here to help you understand CVE-2025-66567. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70