CVE-2025-66568

The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a	Broken Link
https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La biblioteca ruby-saml implementa el lado del cliente de una autorización SAML. Las versiones hasta la 1.12.4 inclusive son vulnerables a la omisión de autenticación a través del proceso de canonicalización de libxml2 utilizado por Nokogiri para la transformación de documentos, lo que permite a un atacante ejecutar un ataque de Signature Wrapping. Cuando se invoca la canonicalización de libxml2 en una entrada XML no válida, puede devolver una cadena vacía en lugar de un nodo canonicalizado. ruby-saml procede entonces a calcular el DigestValue sobre esta cadena vacía, tratándolo como si la canonicalización hubiera tenido éxito. Este problema está corregido en la versión 1.18.0.

Information

Published : 2025-12-09 16:18

Updated : 2026-10-14 21:10

NVD link : CVE-2025-66568

Mitre link : CVE-2025-66568

CVE.ORG link : CVE-2025-66568

JSON object : View

Products Affected

onelogin

ruby-saml

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2025-66568", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66568", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T14:16:24.122600Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "SAML-Toolkits", "product": "ruby-saml", "versions": [{"status": "affected", "version": "< 1.18.0"}]}]}], "published": "2025-12-09T16:18:21.427", "references": [{"url": "https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a", "tags": ["Broken Link"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2\u2019s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0."}, {"lang": "es", "value": "La biblioteca ruby-saml implementa el lado del cliente de una autorizaci\u00f3n SAML. Las versiones hasta la 1.12.4 inclusive son vulnerables a la omisi\u00f3n de autenticaci\u00f3n a trav\u00e9s del proceso de canonicalizaci\u00f3n de libxml2 utilizado por Nokogiri para la transformaci\u00f3n de documentos, lo que permite a un atacante ejecutar un ataque de Signature Wrapping. Cuando se invoca la canonicalizaci\u00f3n de libxml2 en una entrada XML no v\u00e1lida, puede devolver una cadena vac\u00eda en lugar de un nodo canonicalizado. ruby-saml procede entonces a calcular el DigestValue sobre esta cadena vac\u00eda, trat\u00e1ndolo como si la canonicalizaci\u00f3n hubiera tenido \u00e9xito. Este problema est\u00e1 corregido en la versi\u00f3n 1.18.0."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16781771-8893-4189-B51B-66319E3B378C", "versionEndExcluding": "1.18.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}