ruby-saml CVE-2025-66568

The target application must use the ruby-saml library at version 1.12.4 or earlier, configured as a SAML service provider that validates signed SAML responses/assertions via Nokogiri/libxml2 canonicalization. Exploitation requires the attacker to craft invalid XML input that makes libxml2 canonicalization return an empty string so the DigestValue is computed over that empty string, enabling a signature-wrapping attack; the replay variant additionally requires that an empty canonical form was signed at some point (e.g., a prior interaction or misconfigured flow). Limiting factors: only affects deployments actually using ruby-saml for SAML SSO and still on a vulnerable version - no special attacker privileges, authentication, or user interaction are required per the CVSS vector (PR:N/UI:N), making any exposed vulnerable SAML login endpoint reachable by remote unauthenticated attackers.

This is a genuinely high-priority flaw whose signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact (VC:H/VI:H), scoring 9.3 - appropriate for an authentication-bypass/signature-wrapping flaw in a SAML service-provider library, since bypassing SAML signature validation lets an attacker forge assertions and impersonate arbitrary users. The one notable tension is that EPSS is very low (0.24%, 13th percentile) and there is NO CISA KEV listing and no evidence of public exploit code in the provided data - only the vendor GHSA advisory and the fix commit. This low EPSS despite a critical score is typical for a freshly disclosed library vulnerability that is severe in principle but not yet weaponized or widely scanned; it reflects absence of observed exploitation, not low exploitability. SSVC-style reasoning: technical impact is total (auth bypass), and exploitation is automatable in principle once a working signature-wrapping payload exists, but current exploitation status is 'none observed.' Net: treat as a high-priority patch for any Ruby application using ruby-saml as a SAML SP, while noting that real-world exploitation has not yet been demonstrated in the supplied intelligence.

An attacker targeting a Ruby web application that uses ruby-saml (<=1.12.4) as a SAML service provider crafts a malicious SAML response containing XML that triggers a libxml2 canonicalization failure, causing the DigestValue to be computed over an empty string. Using this, the attacker performs a signature-wrapping attack so that forged assertion content is accepted as validly signed, authenticating as an arbitrary (e.g., administrative) user without valid credentials. No public exploit code is identified in the provided data, but the GitHub Security Advisory and fix commit describe the mechanism in detail.