PatchTheCVECVE-2025-66568: The ruby-saml library implements the client side of an SAML authorization
CVE-2025-66568 is a critical-severity flaw (CVSS 9.1) affecting ruby-saml. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 84%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2025-12-09 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-66568?
ruby-saml: upgrade to 1.18.0. Exact commands for each OS are on this page.
Is CVE-2025-66568 being exploited?
CVE-2025-66568 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-66568 affect?
CVE-2025-66568 affects ruby-saml. Severity is critical (CVSS 9.1). The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformatio
How urgent is CVE-2025-66568?
Priority 41/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Ruby vulnerabilities · libxml2 vulnerabilities
Related CVEs
- CVE-2025-66567 CRITICAL 9.1 UPGRADE The ruby-saml library is for implementing the client side of a SAML authorization
- CVE-2025-25293 HIGH 7.5 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- CVE-2025-25292 CRITICAL 9.8 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- CVE-2025-25291 CRITICAL 9.8 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- CVE-2024-45409 CRITICAL 10.0 UPGRADE UPGRADE The Ruby SAML library is for implementing the client side of a SAML authorization