CVE-2025-66568 is a critical (CVSS 9.1) authentication bypass in the ruby-saml library. A failed XML canonicalization step can return an empty string that the library then digests as if it were valid, which opens the door to signature wrapping. The fix is ruby-saml 1.18.0.
What's affected
The NVD record says ruby-saml versions up to and including 1.12.4 are vulnerable, and that version 1.18.0 fixes the problem. The GitHub advisory states the range differently: it lists every release before 1.18.0 as affected, with 1.18.0 as the first patched version. Both agree on the fix. The safe reading is that anything below 1.18.0 needs to move, including the releases between 1.12.4 and 1.18.0.
The advisory rates the issue critical, which matches the record's 9.1. ruby-saml is the client side of SAML single sign on for Ruby applications. It is often pulled in indirectly, for example through an OmniAuth strategy, so a Gemfile that never names it can still ship it.
How to check if you're exposed
Ask Bundler which version your application resolves, and who depends on it:
bundle list | grep -i ruby-saml
bundle info ruby-saml
bundle exec gem dependency ruby-saml --reverse-dependencies
Check every deployable, not just the main app. Background workers, admin tools and older services often carry their own lockfile. If you vendor gems or build container images, scan the image contents as well as the repository.
What to do now
- Find every application that resolves ruby-saml, directly or through another gem.
- Update to ruby-saml 1.18.0 or later and run bundle update ruby-saml, then commit the new lockfile.
- Check that Nokogiri is also current, since the advisory ties the weakness to libxml2 canonicalization through Nokogiri.
- Redeploy, then test a normal SAML login and a deliberately invalid assertion in a staging environment.
- Review identity provider and application logs for unexpected successful logins around your exposure window.
Why it matters
SAML relies on an XML signature over a canonical form of the document. The advisory explains that when libxml2 canonicalizes invalid XML it may return an empty string instead of failing. ruby-saml then computed the digest over that empty string and treated the step as a success. That gap lets an attacker influence what the signature check actually covers, which is the core of a signature wrapping attack.
The weakness is filed as CWE-347, improper verification of a cryptographic signature. The lesson for library authors is simple: a cryptographic check that can silently return an empty result must be treated as a hard failure. CISA's Known Exploited Vulnerabilities list does not include this CVE at the time of the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is ruby-saml 1.15 vulnerable?
The NVD text names versions up to 1.12.4, but the GitHub advisory lists everything before 1.18.0 as affected. Treat 1.15 as vulnerable and upgrade to 1.18.0.
Do I need to touch my identity provider?
The flaw is in how the Ruby application validates the response, so the fix is the gem upgrade. Still review login logs after patching.
Sources
- Safeguard Gold page for CVE-2025-66568
- GitHub security advisory GHSA-x4h9-gwv3-r4m4
- Fix commit in the ruby-saml repository (listed in the record)
Last reviewed: 18 October 2026.
