Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to intelligence
identity-authentication-vulnerabilityopen-source-dependency-vulnerabilitywidely-deployed-product-advisory

Critical Authentication Bypass Vulnerabilities in ruby-saml Library

Updated 23h agoFirst seen Dec 9, 20254 sources

Two critical authentication bypass vulnerabilities have been identified in the ruby-saml library, tracked as CVE-2025-66567 and CVE-2025-66568. Both flaws affect versions up to and including 1.12.4 and allow attackers to execute Signature Wrapping attacks, potentially bypassing SAML authentication. CVE-2025-66568 is caused by Libxml2 canonicalization errors, where invalid XML input may result in an empty string during canonicalization, leading to improper Digest/Signature validation. CVE-2025-66567 arises from differences in XML parsing between ReXML and Nokogiri, resulting in inconsistent document structures and an incomplete fix for a previous vulnerability (CVE-2025-25292). Both vulnerabilities are remotely exploitable and have been rated as critical with a CVSS score of 9.3.

The issues have been addressed in ruby-saml version 1.18.0, and users are strongly advised to update to this version to mitigate the risk of authentication bypass. These vulnerabilities could allow attackers to impersonate users or gain unauthorized access to systems relying on SAML authentication via the affected library. No affected products have been specifically listed, but any application using vulnerable versions of ruby-saml is at risk. Security advisories and technical details have been published to inform the community and facilitate remediation.

Share:
Critical Authentication Bypass Vulnerabilities in ruby-saml Library
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

Start free trial
EVENT TIMELINE

How this story unfolded

7 events from the most recent confirmed update back to the earliest known activity.

7 EVENTS
Dec 11, 20257mo ago

Open-source toolkit released to find and exploit affected deployments

Researchers released an open-source toolkit to help identify and exploit vulnerable SAML implementations in real-world environments. The toolkit operationalized the newly disclosed attack techniques for testing and validation.

Researchers show GitLab EE 17.8.4 compromise via SAML flaws

During the Black Hat Europe research disclosure, the attacks were demonstrated against GitLab Enterprise Edition 17.8.4, showing real-world impact on a major platform. The example illustrated that the SAML weaknesses were exploitable beyond lab conditions.

Black Hat Europe talk demonstrates new SAML signature bypass techniques

At Black Hat Europe, PortSwigger researcher Zak Fedotkin demonstrated XML signature validation bypass techniques involving attribute pollution, namespace confusion, and void canonicalization. The presentation showed how these methods could achieve full authentication bypass in Ruby and PHP SAML ecosystems.

Dec 9, 20257mo ago

Proof-of-concept exploits and GitHub advisories are published

Security advisories and proof-of-concept exploit material for CVE-2025-66567 were published on GitHub, providing technical details for the signature-wrapping authentication bypass. This marked a significant escalation by making exploitation guidance publicly available.

ruby-saml 1.18.0 released to fix CVE-2025-66567

The CVE-2025-66567 advisory states the vulnerability was fixed in ruby-saml version 1.18.0. The update addressed an incomplete prior fix related to parser differentials between REXML and Nokogiri.

Advisories disclose CVE-2025-66567 and CVE-2025-66568 publicly

Public reporting and vulnerability listings on December 9, 2025 disclosed the two critical ruby-saml issues, including that CVE-2025-66567 affected versions up to and including 1.12.4. The disclosures described the bugs as remotely exploitable authentication bypass vulnerabilities.

Researchers identify two critical ruby-saml authentication bypass flaws

Researchers discovered CVE-2025-66567 and CVE-2025-66568 in the ruby-saml library, showing that XML parsing and canonicalization issues could let attackers bypass SAML authentication. The flaws affect applications relying on ruby-saml for signature validation and authentication decisions.

LINKED ENTITIES

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

4 LINKEDOpen in app
Vulnerabilities
2 linked
Authentication bypass (Signature Wrapping) in ruby-saml (ReXML vs Nokogiri parser discrepancy)Authentication bypass in ruby-saml via libxml2 canonicalization empty-string digest (Signature Wrapping)
Organizations
2 linked
PortswiggerGitLab
SOURCE COVERAGE

Sources

4 references tracked. Mallory keeps watching after this page renders.

4 SOURCESView all
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Start free trial
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.

Critical Authentication Bypass Vulnerabilities in ruby-saml Library | Mallory