# CVE-2025-66568: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

Source: https://junglewise.ai/threats/cve-2025-66568-ruby-saml-allows-a-libxml2-canonicalization-error-to-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-09  
License: CC BY 4.0 with a link back

CVE-2025-66568 · Severity: critical · CVSS 9.1 · Published 2025-12-09

The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0.

Technologies: [Onelogin Ruby-Saml](https://junglewise.ai/threats/technologies/ruby-saml), [ruby-saml (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-ruby-saml). Vendors: [Onelogin](https://junglewise.ai/threats/vendors/onelogin), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2025-66568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66568 being exploited in the wild.

**How severe is CVE-2025-66568?** Critical severity, with a CVSS score of 9.1, published 9 December 2025.

**Which products and versions are affected?** ruby-saml (RubyGems) ECOSYSTEM:introduced=0,fixed=1.18.0.

**Is there a fix for CVE-2025-66568?** Yes. ruby-saml (RubyGems): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-66568?** Check whether you run Onelogin Ruby-Saml or ruby-saml (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ruby-saml (RubyGems): upgrade to 1.18.0 or later

  ```sh
  bundle update ruby-saml
  ```


## Affected products

- Onelogin Ruby-Saml
- ruby-saml (RubyGems) ECOSYSTEM:introduced=0,fixed=1.18.0

## Identifiers

- CVE-2025-66568
- GHSA-x4h9-gwv3-r4m4

## Related threats

- [Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)](https://junglewise.ai/threats/cve-2025-66567-ruby-saml-has-a-saml-authentication-bypass-due-to-namespace)
- [Ruby SAML DOS vulnerability with large SAML response](https://junglewise.ai/threats/cve-2025-54572-ruby-saml-dos-vulnerability-with-large-saml-response)
- [Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)](https://junglewise.ai/threats/cve-2025-25292-ruby-saml-allows-a-saml-authentication-bypass-due-to-namespace)
- [Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)](https://junglewise.ai/threats/cve-2025-25291-ruby-saml-allows-a-saml-authentication-bypass-due-to-doctype)
- [Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses](https://junglewise.ai/threats/cve-2025-25293-ruby-saml-allows-remote-denial-of-service-dos-with-compressed)