ruby-saml CVE-2025-66567

Exploitation requires that the target application uses ruby-saml version 1.12.4 or earlier as its SAML service-provider/client library for SSO authentication, with SAML login enabled and an associated IdP trust relationship. The attacker needs a single validly signed SAML assertion (e.g., any legitimately issued token) to wrap, then abuses the divergence between ReXML and Nokogiri XML parsing to have the signature verified over one structure while a different, attacker-chosen assertion is consumed as the identity. No special non-default configuration, user interaction, or prior authentication to the target is required (PR:N/UI:N); the principal limiting factor is simply that the deployment must run an affected ruby-saml version for SAML - applications on 1.18.0+ or not using SAML SSO are unaffected.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, 9.3 Critical) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact - fully consistent with an authentication-bypass/signature-wrapping class (CWE-347). The core risk driver is the security semantics: a SAML signature-wrapping bypass lets an attacker impersonate arbitrary users, which is categorically severe for any SSO-protected application. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis - the severity rests on impact and exploitability metrics rather than observed exploitation. One notable amplifier: this CVE is explicitly an incomplete fix for CVE-2025-25292, meaning the attack surface and signature-wrapping techniques are already publicly documented from the prior CVE, lowering the practical research barrier even without a dedicated POC. No conflicting signals were detected: the CVSS metrics, the description, and the source-code patch (namespace-handling and single-document validation hardening) all point to the same unauthenticated SAML bypass.

An attacker targeting a Ruby application that uses ruby-saml (≤1.12.4) for SAML SSO crafts a malicious SAMLResponse exploiting the fact that ReXML and Nokogiri build different document trees from the same XML. The signature is validated against one parsed structure while a wrapped, attacker-controlled assertion is consumed as the authentication claim, letting the attacker log in as any user. No public exploit is identified in the provided data, but the technique mirrors the prior CVE-2025-25292 signature-wrapping attack that this fix incompletely addressed.