CVE-2025-66567 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

What is CVE-2025-66567?

CVE-2025-66567 is a critical authentication bypass vulnerability in SAML-Toolkits ruby-saml, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

Weakness: CWE-347

Which versions are affected by CVE-2025-66567?

2 open source packages ship an affected version, including ruby-saml. It affects 1 product.

Products include Onelogin Ruby-Saml.

How do I fix CVE-2025-66567?

Upgrade ruby-saml to 1.18.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-66567 being exploited?

There is no known exploitation of CVE-2025-66567 in the wild and no public exploit code.

Other vulnerabilities in SAML-Toolkits ruby-saml

• CVE-2015-20108 ruby-saml vulnerable to XPath injection Critical 9.8
• CVE-2025-66568 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation Critical 9.3
• CVE-2017-11428 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal High 7.7
• CVE-2016-5697 Ruby-saml allows attackers to perform XML signature wrapping attacks High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9v8j-x534-2fx3, UBUNTU-CVE-2025-66567.