xmlseclibs CVE-2025-66578

Exploitation targets xmlseclibs' signature-validation path (XMLSecurityDSig::canonicalizeData): the attacker must supply XML input that is invalid enough that libxml2's C14N canonicalization returns an empty string instead of a canonicalized node, causing the DigestValue to be computed over an empty string. The high-impact variant (signature replay/authentication bypass) additionally requires that a signature over the empty canonical form exists from a prior interaction or a misconfigured authentication flow, which can then be replayed indefinitely. Limiting factors: the attack is only exploitable against applications using xmlseclibs <= 3.1.3 for signature verification (e.g. SAML/XML-DSig consumers), the replay scenario depends on availability of a signature over an empty canonical form, and the flaw is neutralized by the 3.1.4 fix or by the documented workaround of treating nil/empty/exception canonicalization results as fatal.

Signals are mixed and point to a conditional, not mass-exploitable, flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) models a network-reachable, unauthenticated integrity-only impact, which maps to the digest/signature-validation bypass. However, EPSS is low at 0.24% (14th percentile), the CVE is NOT on CISA KEV, and the GHSA advisory itself frames the strongest impact (signature replay) as requiring that an empty canonical form was signed in a prior interaction or via a misconfigured flow - a meaningful precondition the AC:L rating understates. Publicly available exploit code exists (vendor GHSA), but POC availability is distinct from active exploitation and there is no evidence of exploitation in the wild. Net: this is a genuine authentication-bypass weakness in signature verification worth prioritizing for any PHP service that trusts xmlseclibs for XML signature validation (e.g. SAML SSO), but the low EPSS, absent KEV, and conditional replay prerequisite argue this is a targeted/opportunistic risk rather than a broadly wormable one. Note the CVSS AC:L versus the advisory's described preconditions is a conflict - the practical attack complexity is likely higher than the base score implies.

An attacker crafts invalid XML that causes libxml2 canonicalization to return an empty string; xmlseclibs computes the DigestValue over that empty string and treats validation as successful, letting a signature produced over an empty canonical form be replayed to pass authentication checks. Publicly available exploit code is referenced in the vendor GHSA advisory. Because the CVSS vector is AV:N/AC:L/PR:N, the entry point is remote and unauthenticated, though successful replay realistically depends on a previously signed empty canonical form.