CVE-2025-66568: 
Ruby vulnerability analysis and mitigation

CVE-2025-66568 is an authentication bypass vulnerability in the ruby-saml library (RubyGems) that allows unauthenticated remote attackers to execute a Signature Wrapping attack by exploiting a flaw in the libxml2 canonicalization process used by Nokogiri. Versions up to and including 1.12.4 are affected; the vulnerability is fixed in version 1.18.0. It was disclosed on December 8, 2025, by researcher d0ge and published to the GitHub Advisory Database the same day. The vulnerability carries a CVSS v4 base score of 9.3 (Critical) and a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, GHSA).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). When libxml2's canonicalization function is invoked on malformed or invalid XML input, it may silently return an empty string instead of a properly canonicalized node. The ruby-saml library fails to detect this error condition and proceeds to compute the DigestValue over the empty string, treating the canonicalization as successful. This enables two attack paths: (1) Digest bypass — an attacker crafts XML input that triggers the empty-string canonicalization, causing digest validation to pass incorrectly; and (2) Signature replay — if an empty-string digest has been signed in a prior interaction or misconfigured flow, that signature can be replayed to bypass authentication entirely. The attack requires no privileges, no user interaction, and is exploitable over the network with low complexity (GHSA, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to completely bypass SAML-based authentication, gaining unauthorized access to any application or service relying on ruby-saml for SSO. The impact is rated High for both confidentiality and integrity — an attacker can impersonate arbitrary users (including administrators), access protected resources, and manipulate application data. Availability is not directly impacted. Any Ruby application using ruby-saml versions up to 1.12.4 for SAML SSO is within scope, and successful authentication bypass could enable lateral movement within federated identity environments (GHSA).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.048% (15th percentile), indicating a currently low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. Detection is available via Nessus plugin 278384.

1. Reconnaissance: Identify target applications using ruby-saml versions ≤ 1.12.4 for SAML SSO (e.g., via Gemfile.lock exposure, HTTP response headers, or error messages revealing the library version).
2. Craft malformed XML: Construct a SAML Response XML document containing an invalid or malformed XML node in the signed assertion — specifically one that will cause libxml2's canonicalization to return an empty string when processed by Nokogiri.
3. Compute DigestValue over empty string: Because ruby-saml does not validate that canonicalization produced a non-empty result, it computes the SHA digest over the empty string "". The attacker pre-computes this known digest value.
4. Inject crafted SAML Response: Submit the malformed SAML Response (with the pre-computed empty-string DigestValue) to the target application's SAML Assertion Consumer Service (ACS) endpoint, typically via HTTP POST to /saml/consume or equivalent.
5. Bypass signature validation: The library accepts the digest as valid (since it matches the digest of the empty string), allowing the attacker to pass signature validation with a forged or replayed signature.
6. Achieve authentication bypass: The attacker is authenticated as an arbitrary user (e.g., an administrator) specified in the crafted SAML assertion's NameID or attribute fields, gaining full unauthorized access (GHSA).

• Network: Unexpected or anomalous HTTP POST requests to SAML ACS endpoints (e.g., /saml/consume) from unknown or untrusted IP addresses; SAML Responses submitted outside of normal IdP-initiated flows.
• Logs: Application logs showing successful SAML authentication events for privileged or unexpected user accounts without corresponding IdP-side login events; authentication successes immediately following malformed XML parsing warnings or errors in application logs.
• File System: No specific file artifacts are expected from this authentication bypass alone, but post-exploitation activity may leave web shells, modified configuration files, or new user accounts.
• Process/Application Behavior: Accounts logging in from unexpected geographic locations or at unusual times following SAML authentication; session tokens issued for high-privilege accounts without corresponding MFA or IdP audit log entries.

The primary remediation is to upgrade ruby-saml to version 1.18.0 or later (the project README also recommends 1.18.1 to address a subsequent CVE-2025-54572). No configuration-based workaround fully mitigates this vulnerability; if immediate patching is not possible, consider temporarily disabling SAML authentication and using an alternative authentication method. Organizations should audit all Ruby applications using ruby-saml, review SAML authentication logs for anomalous activity, and implement additional authentication layers (e.g., MFA) as a defense-in-depth measure (GHSA, ruby-saml repo).

Security Online reported on the vulnerability alongside the companion flaw CVE-2025-66567, describing both as critical authentication bypass flaws in the ruby-saml library. PortSwigger Research published a technical write-up titled "The Fragile Lock" covering SAML vulnerabilities in this class. CSO Online covered the broader theme of SAML authentication weaknesses. Community discussion was noted on Bluesky and various vulnerability tracking platforms shortly after disclosure. The ruby-saml project maintainer (pitbulk) published the advisory and patch promptly on December 8, 2025 (Security Online, PortSwigger Research).