CVE-2025-66567
Critical
Description
The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.
SeverityCritical
CVSS9.1
Exploit probability—
ProductOnelogin Ruby-saml
PublishedDec 9, 2025
First seenDec 9, 2025
Weakness typeCWE-347CWE-347
How to fix
Update
- onelogin ruby-saml1.18.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| onelogin ruby-saml | v < 1.18.0 | 1.18.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.