CVE-2025-66567

The vulnerability stems from differences in how XML documents are parsed by the ReXML and Nokogiri libraries — they generate completely different document tree structures from the same input XML document. An attacker can craft a malicious SAML response that will be correctly verified by one library, while the other will process it in a way that allows injection of untrusted content as authenticated. As a result, the digital signature of the SAML response becomes associated with a different fragment of the document than the one actually processed by the application (Signature Wrapping attack), allowing user identity spoofing.

An attacker can bypass the SAML authentication mechanism and log in as any user, including an administrator, without knowing the password or possessing a valid certificate. This results in a complete breach of confidentiality and integrity of data accessible in the application.

The ruby-saml library should be updated to version 1.18.0, in which the vulnerability has been fixed. Patches and details are available in the vendor references and in the security advisory GHSA-9v8j-x534-2fx3.

ruby-saml library (OneLogin) in versions up to 1.12.4 inclusive