The ruby-saml library is for implementing the client side of a SAML authorization.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Dec 9, 2025 · NIST NVD

   Detected

   The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. Th

2. Oct 14, 2026 · NIST NVD

   Updated

   The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. Th

Affected

• cpe onelogin/ruby-samlversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-66567

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-66567

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2025-66567

  The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entire

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com
• Not Applicable · github.com