Authentication Bypass in ruby-saml Library by Vendor SAML-Toolkits

CVE-2025-66568

What is CVE-2025-66568?

The ruby-saml library, which handles client-side SAML authorization, is susceptible to an authentication bypass due to the libxml2 canonicalization process utilized by Nokogiri for document transformation. This vulnerability affects versions up to and including 1.12.4. An attacker could exploit this flaw to execute a Signature Wrapping attack by providing invalid XML input. When the canonicalization is applied, libxml2 may yield an empty string instead of the expected canonicalized node, leading ruby-saml to erroneously compute the DigestValue over this empty result. Consequently, this can allow unauthorized access to the system. The issue has been resolved in version 1.18.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References