PT-2025-49775 · Libxml2+2 · Libxml2+2

Published 2025-12-09 · Updated 2026-01-15 · CVE-2025-66568

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ruby-saml versions through 1.12.4

Description The ruby-saml library, which handles SAML authorization on the client side, has a flaw that could allow an attacker to bypass authentication. This is due to how the library processes XML data using Nokogiri and libxml2. Specifically, the canonicalization process within libxml2, when given invalid XML, can return an empty string instead of a properly canonicalized version. ruby-saml then calculates a DigestValue based on this empty string, incorrectly assuming the canonicalization was successful. This enables a Signature Wrapping attack.

Recommendations Update to version 1.18.0 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-66568

GHSA-X4H9-GWV3-R4M4

Affected Products

Nokogiri

Libxml2

Ruby-Saml

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66568.json · Exploit
• https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-66568 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66568 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66568 · Security Note
• https://ubuntu.com/security/CVE-2025-66568 · Vendor Advisory
• https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a · Note
• https://twitter.com/CVEnew/status/1998225344869106102 · Twitter Post
• https://twitter.com/rubylandnews/status/1999605319366758849 · Twitter Post
• https://twitter.com/NCIIPC/status/1998351941387042963 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/1998253070442996035 · Twitter Post
• https://twitter.com/fridaysecurity/status/1998218676265496790 · Twitter Post
• https://t.me/CVEtracker/39189 · Telegram Post
• https://twitter.com/Komodosec/status/2011634339956867138 · Twitter Post