CVE-2025-66568

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-66568
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66568.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66568
Aliases
Downstream
Published
2025-12-09T02:03:20.397Z
Modified
2025-12-09T19:46:24.397827Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation
Details

The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66568.json"
}
References

Affected packages

Git / github.com/saml-toolkits/ruby-saml

Affected ranges

Type
GIT
Repo
https://github.com/saml-toolkits/ruby-saml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6a7c040049babe748ee1bb4ca13898c47189114c
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.18.0"
        }
    ]
}

Affected versions

0.*

0.7.3
0.8.0
0.8.1

1.*

1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0

v0.*

v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.7.1
v0.9
v0.9.1
v0.9.2

v1.*

v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.10.0
v1.10.1
v1.10.2
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.2.0
v1.3.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.9.0