CVE-2025-66567 - CVE House

Back to Database

Status published Critical CVE-2025-66567

ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

9.3 CVSS

Vulnerability Description

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66567

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAML-Toolkits

View All →

ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation

Ruby SAML DOS vulnerability with large SAML response

ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

Affected Vendor

SAML-Toolkits

View all reports →

Affected Software

ruby-saml

Vulnerable Versions:

< 1.18.0

Timeline

Official Publish: December 9th, 2025

Last Modified: December 9th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1565 Data Manipulation