CVE-2025-66567: falha crítica em SAML-Toolkits ruby-saml
ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.4%
The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
SAML-Toolkits · ruby-samlCVEs relacionadas — SAML-Toolkits ruby-saml
No mesmo produto, das mais perigosas para as menos.
CVE-2025-25292CRITICALRuby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)EPSS 65.1%CVE-2025-25291CRITICALruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)EPSS 21.0%CVE-2024-45409CRITICALThe Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectorEPSS 12.5%CVE-2025-25293HIGHruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responsesEPSS 1.5%CVE-2025-54572MEDIUMRuby SAML DOS vulnerability with large SAML responseEPSS 0.5%CVE-2025-66568CRITICALruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationEPSS 0.3%