N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66568

CVE-2025-66568: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

Summary

Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an issue at libxml2 canonicalization process used by Nokogiri for document transformation. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.

Details

When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded.

Impact

Digest bypass: By crafting input that causes canonicalization to yield an empty string, the attacker can manipulate validation to pass incorrectly.
Signature replay on empty canonical form: If an empty string has been signed once (e.g., in a prior interaction or via a misconfigured flow), that signature can potentially be replayed to bypass authentication.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66568

CVE-2025-66568:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ruby-saml	rubygems	< 1.18.0	1.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in ruby-saml (GHSA-x4h9-gwv3-r4m4) is a critical authentication bypass caused by two related issues: improper handling of XML canonicalization errors and a signature wrapping flaw.

Canonicalization Bypass: The core of the vulnerability lies in the XMLSecurity::SignedDocument.validate_signature function. Before the patch, this function would attempt to canonicalize and then compute a digest of a signed XML element. However, due to an issue in the underlying libxml2 library, if the XML element was malformed, the canonicalization process could fail and return an empty string. The ruby-saml library did not check for this failure and would proceed to compute the digest of the empty string. An attacker could exploit this by crafting a SAML response with a malformed element and a pre-computed digest for an empty string, thereby bypassing the signature check.

The fix involves introducing strict XML validation before attempting canonicalization. The validate_signature function was refactored, and a new cache_referenced_xml function was added, which uses a new safe_load_xml utility. This utility explicitly checks for XML parsing errors and rejects invalid documents, preventing the canonicalization flaw from being triggered.

Signature Wrapping: The OneLogin::RubySaml::Response.xpath_first_from_signed_assertion and xpath_from_signed_assertion functions were vulnerable to signature wrapping. These functions were used to retrieve attributes and other data from a signed assertion. However, their XPath queries searched the entire SAML document for an assertion with a matching ID. This allowed an attacker to include a validly signed dummy assertion alongside a malicious, unsigned assertion. The vulnerable functions could then mistakenly extract data from the malicious assertion, believing it to be authenticated.

The patch corrects this by changing the logic to operate only on the XML that is explicitly covered by the signature, which is cached by the cache_referenced_xml function. This ensures that data is only extracted from the authenticated part of the document, mitigating the signature wrapping attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-66568: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

Summary

Details

Impact

CVE-2025-66568:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-66568: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

Summary

Details

Impact

N/A

N/A

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI