Ruby SAML Library Vulnerability Let Attackers Bypass Authentication

A critical vulnerability has been discovered in the Ruby SAML library that could allow attackers to bypass authentication mechanisms in affected applications completely.

The flaw, tracked as CVE-2025-66567, impacts all versions up to and including 1.12.4 and has been assigned a critical CVSS score of 10.0.

The vulnerability stems from an incomplete fix for a previously disclosed issue (CVE-2025-25292).

XML Parser Flaw Enables Signature Wrapping Attack

The core problem lies in how different XML parsers, specifically ReXML and Nokogiri, interpret XML documents differently.

This parsing discrepancy creates an opportunity for attackers to execute a Signature Wrapping attack.

This manipulates XML signatures in SAML authentication tokens to bypass security controls.

Field	Details
CVE ID	CVE-2025-66567
Affected Package	ruby-saml (RubyGems)
CVSS Score	10.0
Attack Vector	Network
CWE	CWE-347 (Improper Verification of Cryptographic Signature)
Weakness	Signature Wrapping Attack

SAML (Security Assertion Markup Language) is widely used for single sign-on (SSO) authentication across enterprise applications.

A successful attack exploiting this vulnerability would grant attackers unauthorized access to systems without providing valid credentials.

Potentially affecting thousands of organizations relying on SAML-based authentication.

The attack requires no user interaction, no special privileges. It can be launched over the network, making it particularly dangerous for remote exploitation.

An attacker could craft malicious SAML responses that appear legitimate to the vulnerable parser while containing unauthorized modifications to authentication claims.

Security experts emphasize the urgency of this issue given the flaw’s authentication-bypass nature.

Organizations using Ruby SAML should immediately upgrade to version 1.18.0 or later, which patches this vulnerability.

The weakness is classified under CWE-347 (Improper Verification of Cryptographic Signature), indicating fundamental issues with how the library validates digital signatures on SAML assertions.

The vulnerability was discovered and reported through GitHub’s advisory process, highlighting the importance of robust XML parsing implementations in security-critical authentication libraries.

Development teams should prioritize this patch in their security maintenance schedule, particularly for applications that handle sensitive business operations or user data.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Ruby SAML Library Vulnerability Let Attackers Bypass Authentication appeared first on Cyber Security News.