CVE-2025-66567: 
Ruby vulnerability analysis and mitigation

CVE-2025-66567 is a SAML authentication bypass vulnerability in the ruby-saml library caused by an incomplete fix for CVE-2025-25292. It affects ruby-saml versions up to and including 1.12.4 (all versions below 1.18.0), which implement the client side of SAML authorization for Ruby applications. The vulnerability was disclosed on December 8, 2025, and is fixed in version 1.18.0. It carries a CVSS v3.1 score of 9.1 (Critical) and a CVSS v4.0 score of 9.3 (Critical) (Github Advisory).

The root cause is an XML parser differential between ReXML and Nokogiri (CWE-347: Improper Verification of Cryptographic Signature). Because these two parsers generate entirely different document structures from the same XML input, an attacker can craft a malicious SAML response that passes signature validation under one parser while presenting attacker-controlled content to the other — a classic XML Signature Wrapping (XSW) attack. The prior fix for CVE-2025-25292 was incomplete, leaving versions up to 1.12.4 still exploitable via namespace handling inconsistencies. The patch in version 1.18.0 addresses this by unifying how signed assertions are extracted and validated, using a signed_assertion cache derived from the canonicalized, signature-verified XML rather than re-querying the parsed document (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to bypass SAML-based authentication entirely, potentially impersonating any legitimate user — including administrators — without valid credentials. The confidentiality and integrity impacts are both rated High, as an attacker can gain unauthorized access to protected resources and manipulate authentication state. Availability is not directly impacted, but account takeover and identity spoofing can lead to significant downstream compromise of any application relying on ruby-saml for SSO (Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit specifically for CVE-2025-66567, and no evidence of in-the-wild exploitation has been reported (Github Advisory). The EPSS score is approximately 0.074%, placing it in the 16th percentile for near-term exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the closely related predecessor CVE-2025-25292 had an EPSS score of ~3.3% and was widely discussed, and the underlying XSW technique is well-understood by attackers, making weaponization feasible for skilled adversaries (Github Advisory).

1. Identify target: Locate a web application using ruby-saml versions < 1.18.0 (specifically ≤ 1.12.4) for SAML SSO, identifiable via HTTP responses, error messages, or open-source intelligence.
2. Obtain a valid SAML response: Authenticate as a low-privileged or guest user (if self-registration is available) to obtain a legitimate, IdP-signed SAML response, or intercept one via a man-in-the-middle position.
3. Craft a Signature Wrapping payload: Manipulate the XML structure of the SAML response to exploit the ReXML/Nokogiri parser differential — insert a forged <Assertion> element with attacker-controlled attributes (e.g., target username/role) in a position that Nokogiri's signature validation ignores but ReXML's assertion extraction reads.
4. Exploit namespace handling: Use XML namespace tricks (e.g., redefining namespace prefixes) so that the signed element validated by one parser differs from the assertion content consumed by the other, bypassing signature verification.
5. Submit the crafted response: POST the manipulated SAMLResponse to the application's SAML consumer endpoint (e.g., /saml/consume).
6. Achieve authentication bypass: The application accepts the forged assertion, establishing a session as the impersonated user (e.g., an administrator), granting full unauthorized access (Github Advisory, PortSwigger Research).

• Network: Unexpected or anomalous HTTP POST requests to SAML consumer endpoints (e.g., /saml/consume, /auth/saml/callback) containing unusually large or structurally complex SAMLResponse parameters; SAMLResponse values with duplicate or nested <Assertion> elements when base64-decoded.
• Logs: Application authentication logs showing successful logins for privileged accounts (e.g., admin) from unexpected IP addresses or at unusual times without a corresponding prior authentication request; SAML response processing errors followed immediately by successful session creation.
• File System / Session: New privileged sessions created without corresponding IdP-initiated login flows; session tokens associated with high-privilege accounts appearing without MFA or expected login patterns.
• XML Artifacts: SAMLResponse payloads (if logged) containing multiple <Assertion> blocks, mismatched namespace prefixes, or <Signature> elements referencing a different element ID than the assertion being consumed.

The primary remediation is to upgrade ruby-saml to version 1.18.0 or later, which contains a complete fix for the parser differential issue (Github Advisory, ruby-saml repo). Note that the ruby-saml README also references version 1.18.1 as addressing a subsequent CVE (CVE-2025-54572), so upgrading to the latest available release is recommended. If immediate patching is not possible, consider temporarily disabling SAML authentication and falling back to alternative authentication methods, and implement strict monitoring of SAML consumer endpoints for anomalous activity.

The vulnerability was covered by security news outlets including SecurityOnline and CybersecurityNews shortly after disclosure, noting it as a critical authentication bypass affecting SAML implementations (SecurityOnline). PortSwigger Research published a related technical write-up titled "The Fragile Lock" discussing SAML parser differential attacks in this class of vulnerabilities (PortSwigger Research). The Hacker News weekly recap included mention of the vulnerability alongside other notable December 2025 disclosures. Red Hat also tracked the CVE, indicating relevance to downstream enterprise consumers of the library (Red Hat).