N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66567

CVE-2025-66567: Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

Summary

Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.

Impact

That allows an attacker to be able to execute a Signature Wrapping attack and bypass the authentication

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66567

CVE-2025-66567:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ruby-saml	rubygems	< 1.18.0	1.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Signature Wrapping attack due to a parser differential between Ruby's REXML and Nokogiri XML parsers. The ruby-saml library used Nokogiri for cryptographic signature validation but allowed the application to use REXML for extracting data from the SAML response. An attacker could craft a SAML response containing both a validly signed (but ignored) assertion and a malicious, unsigned assertion. The different parsers would produce different document structures, causing the signature validation logic to check the benign assertion while the data extraction logic would read from the malicious one, leading to an authentication bypass.

The patch addresses this by fundamentally changing how the XML document is handled. It introduces a single, secure XML loading mechanism (XMLSecurity::BaseDocument.safe_load_xml) that is used consistently. More importantly, the signature validation process in XMLSecurity::SignedDocument.validate_signature was refactored. The new logic first identifies the exact XML element that the signature covers (the referenced_xml), validates its digest, and then ensures that all subsequent data extractions (via methods like OneLogin::RubySaml::Response.xpath_first_from_signed_assertion) can only 'see' this cryptographically verified part of the document. This prevents the application from ever accessing the malicious, unsigned parts of a wrapped SAML response.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.