CVE-2025-66567

criticalpriority · track · 36EPSS 0.004 · 36 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 9.1 · critical

Is it mine?

9 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0.

cvss

Technical severity, 0–10. One row per scoring source.

9.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8–9.3

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.08highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347US

affected products (9)

Products and version ranges known to be affected.

NetApp StorageGRID <11.9.0all versionscert_bundDE
NetApp StorageGRID <12.0all versionscert_bundDE
Open Source Ruby SAML <1.18.0all versionscert_bundDE
NetApp StorageGRID< 11.9.0cert_bundDE
NetApp StorageGRID< 12.0cert_bundDE
Open Source Ruby≤ SAML <1.18.0cert_bundDE
SAML-Toolkits Ruby-SAML≤ < 1.18.0enisa_euvdEU
onelogin ruby-saml< 1.18.0nvdUScpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*
RubyGems ruby-saml< 1.18.0osvUSpkg:gem/ruby-saml

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2764Ruby SAML: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2025-12-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby SAML ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-9v8j-x534-2fx3Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)2025-12-08ghsa · osvUS
### Summary Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0. ### Impact That allows an attacker to be able to execute a Signature Wrapping attack and bypass the authentication

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2025-12-09modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan