GHSA-5j8p-438x-rgg5 SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Attackers can impersonate users via signature wrapping in the SAML PHP Toolkit, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5j8p-438x-rgg5?
GHSA-5j8p-438x-rgg5 is an authentication bypass vulnerability in onelogin/php-saml, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Which versions are affected by GHSA-5j8p-438x-rgg5?
6 open source packages ship an affected version, including onelogin/php-saml.
| Package | Affected | Fixed in |
|---|---|---|
onelogin/php-saml Packagist | All versions | 2.21.1 |
onelogin/php-saml Packagist | All versions | 2.21.1 |
onelogin/php-saml Packagist | From 3.0.0 | 3.8.1 |
onelogin/php-saml Packagist | From 3.0.0 | 3.8.1 |
onelogin/php-saml Packagist | From 4.0.0 | 4.3.1 |
onelogin/php-saml Packagist | From 4.0.0 | 4.3.1 |
How do I fix GHSA-5j8p-438x-rgg5?
Upgrade onelogin/php-saml to a fixed version for your release line: 2.21.1, 3.8.1 or 4.3.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-5j8p-438x-rgg5 being exploited?
There is no known exploitation of GHSA-5j8p-438x-rgg5 in the wild and no public exploit code.