Authentication Bypass in ruby-saml Library by Vendor SAML-Toolkits

CVE-2025-66568

What is CVE-2025-66568?

The ruby-saml library, which handles client-side SAML authorization, is susceptible to an authentication bypass due to the libxml2 canonicalization process utilized by Nokogiri for document transformation. This vulnerability affects versions up to and including 1.12.4. An attacker could exploit this flaw to execute a Signature Wrapping attack by providing invalid XML input. When the canonicalization is applied, libxml2 may yield an empty string instead of the expected canonicalized node, leading ruby-saml to erroneously compute the DigestValue over this empty result. Consequently, this can allow unauthorized access to the system. The issue has been resolved in version 1.18.0.

References