CVE-2025-66567 is a critical (CVSS 9.1) authentication bypass in ruby-saml. REXML and Nokogiri parse the same XML differently, which allows a signature wrapping attack. It is an incomplete fix for CVE-2025-25292. Versions before 1.18.0 are affected, and 1.18.0 fixes it.
What's affected
- Package: ruby-saml on RubyGems, used for the service provider side of SAML single sign on.
- Affected: the record says versions up to and including 1.12.4. The advisory gives the range as before 1.18.0.
- Fixed: 1.18.0. The advisory says 1.18.0 is not affected.
Version wording differs. The record text names 1.12.4 as the top affected version, and the advisory says everything below 1.18.0 is affected. Use the advisory range: anything older than 1.18.0 should be upgraded.
Severity: the record scores 9.1 under CVSS 3.1, and the advisory shows 9.3 under CVSS 4.0. Both are critical.
How to check if you're exposed
Check the installed version in each Ruby application that does SAML login, including those that use it indirectly through a gem such as omniauth-saml.
bundle list | grep -i saml
bundle exec gem list ruby-saml
grep -n "ruby-saml" Gemfile.lock
Any version below 1.18.0 needs attention. Also look at your SAML setup: does your application accept assertions from a single trusted identity provider, and is the login endpoint reachable from the internet?
What to do now
- Upgrade ruby-saml to 1.18.0 or later with
bundle update ruby-saml, then check that gems that depend on it accept the new version. - Deploy and confirm in Gemfile.lock that no older copy remains in any service.
- Review SAML login logs for the exposure period, especially sessions that do not match a normal identity provider flow.
- Rotate long lived sessions for privileged users if you find anything suspicious.
- Make sure your tests include a SAML login after the upgrade.
- Scan your Ruby projects for the version. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory says ReXML and Nokogiri build different document structures from the same input. If one library is used to check the signature and the other to read the identity, an attacker can arrange the XML so that a valid signature covers one part while the application reads claims from another. This is a signature wrapping attack, and the record tags it CWE-347, improper verification of a cryptographic signature.
The advisory notes this is the result of an incomplete fix for CVE-2025-25292, a reminder that parser differentials are hard to close in one patch. SAML is the front door for many enterprise apps, so a bypass can mean access as any user. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Quick check
Which version fixes CVE-2025-66567?
ruby-saml 1.18.0. The advisory says that version is not affected.
Why was the earlier fix not enough?
The advisory says it was incomplete because REXML and Nokogiri parse XML differently, which still allowed signature wrapping.
Sources
Last reviewed: 18 October 2026.
