---
id: CVE-2025-66567
title: >-
  The ruby-saml library is for implementing the client side of a SAML
  authorization
summary: >-
  The ruby-saml library is for implementing the client side of a SAML
  authorization. ruby-saml versions up to and including 1.12.4 contain an
  authentication bypass vulnerability due to an incomplete fix for
  CVE-2025-25292. ReXML and Nokogi…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-347
vendor: onelogin
product: ruby-saml
affected:
  - ruby-saml < 1.18.0
patched:
  - ruby-saml 1.18.0
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66567'
references:
  - url: >-
      https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
    label: security-advisories@github.com
  - url: >-
      https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-754f-8gm6-c4r2'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00392
epssPercentile: 0.31647
ingestedAt: '2026-10-14T21:57:04.742Z'
---

## Overview

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

## Affected

- `ruby-saml < 1.18.0`

## Remediation

Upgrade past the affected range:

- `ruby-saml 1.18.0`