CVE-2025-66567
NoneCVSS
—
EPSS
0.4%
Published
Dec 9, 2025
CISA due date
—
The record
ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | ruby-saml | 0 | 1.12.4 |
| RubyGems | ruby-saml | 0 | 1.18.0 |
| RubyGems | ruby-saml | 1.13.0 | 1.18.0 |
Related vulnerabilities
- GHSA-9v8j-x534-2fx3 Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) Same vulnerability
- CVE-2025-66568 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation Also affects ruby-saml
- GHSA-x4h9-gwv3-r4m4 Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation Also affects ruby-saml
- CVE-2025-25291 Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser… Also affects ruby-saml
- CVE-2025-25292 Ruby SAML allows a SAML authentication bypass due to namespace handling (parser… Also affects ruby-saml
- CVE-2024-45409 The Ruby SAML library is for implementing the client side of a SAML authorization. Also affects ruby-saml
- CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
- CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347