CVE-2025-66578
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xmlseclibs | xmlseclibs | 3.1.3 |
| xmlseclibs | xmlseclibs | 3.1.4 |
| xmlseclibs_project | xmlseclibs | to 3.1.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-248 | An exception is thrown from a function, but it is not caught. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in xmlseclibs version 3.1.3, a PHP library for XML Encryption and Signatures. It is caused by a flaw in the libxml2 canonicalization process during document transformation. When libxml2 canonicalization is applied to invalid XML input, it may return an empty string instead of a canonicalized node. xmlseclibs then computes the DigestValue over this empty string, mistakenly treating it as a successful canonicalization. This leads to an authentication bypass vulnerability.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass authentication mechanisms that rely on XML signature validation. Because the library may accept an empty string as a valid canonicalized node, it could lead to accepting tampered or invalid XML documents as authentic, potentially compromising confidentiality, integrity, and availability of the system using xmlseclibs.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the version of the xmlseclibs library in use. Versions 3.1.3 are vulnerable, while version 3.1.4 contains the fix. Additionally, monitoring for authentication bypass attempts related to XML signature validation failures may help. There are no specific commands provided to detect this vulnerability on a network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading xmlseclibs to version 3.1.4 or later. As workarounds, treat canonicalization failures (exceptions or nil/empty outputs) as fatal and abort validation, and/or add explicit checks to reject when canonicalize returns nil/empty or raises errors.