Loading story…
Two critical authentication bypass vulnerabilities have been identified in the ruby-saml library, tracked as CVE-2025-66567 and CVE-2025-66568. Both flaws affect versions up to and including 1.12.4 and allow attackers to execute Signature Wrapping attacks, potentially bypassing SAML authentication. CVE-2025-66568 is caused by Libxml2 canonicalization errors, where invalid XML input may result in an empty string during canonicalization, leading to improper Digest/Signature validation. CVE-2025-66567 arises from differences in XML parsing between ReXML and Nokogiri, resulting in inconsistent document structures and an incomplete fix for a previous vulnerability (CVE-2025-25292). Both vulnerabilities are remotely exploitable and have been rated as critical with a CVSS score of 9.3.
The issues have been addressed in ruby-saml version 1.18.0, and users are strongly advised to update to this version to mitigate the risk of authentication bypass. These vulnerabilities could allow attackers to impersonate users or gain unauthorized access to systems relying on SAML authentication via the affected library. No affected products have been specifically listed, but any application using vulnerable versions of ruby-saml is at risk. Security advisories and technical details have been published to inform the community and facilitate remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers released an open-source toolkit to help identify and exploit vulnerable SAML implementations in real-world environments. The toolkit operationalized the newly disclosed attack techniques for testing and validation.
During the Black Hat Europe research disclosure, the attacks were demonstrated against GitLab Enterprise Edition 17.8.4, showing real-world impact on a major platform. The example illustrated that the SAML weaknesses were exploitable beyond lab conditions.
At Black Hat Europe, PortSwigger researcher Zak Fedotkin demonstrated XML signature validation bypass techniques involving attribute pollution, namespace confusion, and void canonicalization. The presentation showed how these methods could achieve full authentication bypass in Ruby and PHP SAML ecosystems.
Security advisories and proof-of-concept exploit material for CVE-2025-66567 were published on GitHub, providing technical details for the signature-wrapping authentication bypass. This marked a significant escalation by making exploitation guidance publicly available.
The CVE-2025-66567 advisory states the vulnerability was fixed in ruby-saml version 1.18.0. The update addressed an incomplete prior fix related to parser differentials between REXML and Nokogiri.
Public reporting and vulnerability listings on December 9, 2025 disclosed the two critical ruby-saml issues, including that CVE-2025-66567 affected versions up to and including 1.12.4. The disclosures described the bugs as remotely exploitable authentication bypass vulnerabilities.
Researchers discovered CVE-2025-66567 and CVE-2025-66568 in the ruby-saml library, showing that XML parsing and canonicalization issues could let attackers bypass SAML authentication. The flaws affect applications relying on ruby-saml for signature validation and authentication decisions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released emergency updates for GitLab CE and EE to fix nine vulnerabilities, including two critical authentication flaws in the third-party `ruby-saml` library that can let an attacker impersonate arbitrary users in SAML SSO deployments. The issues, tracked as `CVE-2025-25291` and `CVE-2025-25292`, stem from SAML parser differential behavior that can enable a valid SAML-signing party to bypass authentication checks and effectively sign in as another user. GitHub security researchers disclosed the underlying SAML weakness, describing how parser inconsistencies can break trust assumptions in SSO authentication flows.
Jul 24, 2026
Drupal disclosed **SA-CONTRIB-2026-031**, a critical authentication bypass vulnerability in the **SAML SSO - Service Provider** module affecting versions prior to `3.1.4`. The Canadian Centre for Cyber Security warned that organizations using the product should review Drupal’s guidance and apply the vendor update, as the flaw could allow unauthorized access through affected single sign-on deployments. Separately, Samba maintainers announced upcoming security releases for versions `4.22`, `4.23`, and `4.24` to address six vulnerabilities spanning file services, domain members, and Active Directory Domain Controller components. A follow-up correction said a **CVSS 10.0** file-services issue affects uncommon configurations rather than some configurations, and clarified that one Active Directory-related flaw impacts domain members rather than AD domain controllers; administrators were urged to deploy the Samba updates promptly after release.
Jun 29, 2026
GitLab released emergency security updates across multiple CE and EE versions to fix **CVE-2024-45409**, a critical SAML authentication bypass affecting self-managed instances configured for SAML-based sign-in. The company said the issue was mitigated by updating `omniauth-saml` to `2.2.1` and `ruby-saml` to `1.17.0`, and urged administrators to upgrade immediately to patched releases spanning the 17.x and 16.x branches. GitLab.com and GitLab Dedicated were already remediated and were not exposed in the same way. GitLab also published mitigation and threat-hunting guidance for organizations that could not patch immediately, including enforcing GitLab two-factor authentication for all users and disabling the SAML two-factor bypass option. To help defenders identify attempted or successful exploitation, the advisories pointed to review of `application_json` and `auth_json` logs and shared Sigma-style detection ideas focused on anomalous `extern_uid` values and suspicious IP mismatches during authentication events.
Jul 24, 2026