Read the docs
TI-2025-40979 Aliases CVE-2025-66568GHSA-x4h9-gwv3-r4m4

ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation

Priority MEDIUM 48CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed ruby-saml (SAML-Toolkits): 1.18.0ruby-saml (RubyGems): 1.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAML-Toolkitsruby-samlbefore 1.18.01.18.0Patch availableCNA
—ruby-saml (RubyGems)before 1.18.01.18.0Patch availableGHSA-x4h9-gwv3-r4m4
  • ruby-saml VendorSAML-Toolkits Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA
  • ruby-saml (RubyGems) Vendor— Affected before 1.18.0 Fixed in 1.18.0 Patch available GHSA-x4h9-gwv3-r4m4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*before 1.18.0VulnerableSAML-Toolkits
  • cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* Versions before 1.18.0 Vulnerable ·SAML-Toolkits

Remediation

  • Fix · CNA ruby-saml (SAML-Toolkits) Fixed in 1.18.0
  • Fix · GHSA-x4h9-gwv3-r4m4 ruby-saml (RubyGems) Fixed in 1.18.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66568
  2. 2026-10-03 Alias added: GHSA-x4h9-gwv3-r4m4

References

Advisory 2

Other 3

  • TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2024-30458 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVSS 3.1CRITICAL 10.0
  • TI-2025-18945 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2015-08083 xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and… CVSS 3.1CRITICAL 9.8
  • TI-2025-40978 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2017-08453 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal CVSS 3.0CRITICAL 9.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences