Critical Authentication Bypass Flaws Discovered in Ruby SAML Library (CVE-2025-66567 & CVE-2025-66568)

A pair of critical authentication bypass vulnerabilities has been disclosed in the Ruby SAML library, affecting versions up to and including 1.12.4 and carrying a CVSS score of 9.3. According to the advisory, the library relies on two different XML parsers, ReXML and Nokogiri, which parse XML differently, enabling a Signature Wrapping attack that could allow an attacker to bypass authentication.

The second flaw, CVE-2025-66568, exploits a failure in Libxml2 used by Nokogiri during canonicalization, where invalid input can yield an empty string that ruby-saml then signs as if canonicalisation succeeded, creating Digest Bypass and Signature Replay vectors. Upgrading to version 1.18.0 or later is recommended, as that release addresses both issues.

The article notes that the vulnerabilities could allow malicious actors to impersonate users without valid credentials, and urges immediate patching for those using ruby-saml.