BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-10

Assigner: GitHub, Inc.

Description

The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-09

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-12-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66568

Affected Vendors & Products

Vendor	Product	Version / Range
ruby-saml	ruby-saml	1.12.4
ruby-saml	ruby-saml	1.18.0
onelogin	ruby-saml	to 1.18.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the ruby-saml library versions up to 1.12.4, where an attacker can bypass authentication by exploiting the libxml2 canonicalization process used by Nokogiri. When libxml2 processes invalid XML input, it may return an empty string instead of a canonicalized node. ruby-saml then incorrectly computes the DigestValue over this empty string, allowing a Signature Wrapping attack that can bypass authentication.

Impact Analysis

This vulnerability can allow an attacker to bypass authentication mechanisms in applications using vulnerable versions of ruby-saml, potentially granting unauthorized access to protected resources or systems.

Mitigation Strategies

Upgrade the ruby-saml library to version 1.18.0 or later, as this version contains the fix for the authentication bypass vulnerability caused by the libxml2 canonicalization process.

Hi! I’m here to help you understand CVE-2025-66568. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70