# ruby-saml bypass after 1.12.4, PortSwigger Fragile Lock

Source: https://startwithidentity.com/cves/cve-2025-66567/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

PortSwigger's December 2025 research, "The Fragile Lock," showed that ruby-saml versions below 1.18.0, including 1.12.4 (the first patched line for the March bugs), still accepted forged [SAML](https://startwithidentity.com/glossary/saml/) assertions. CVE-2025-66567 and [CVE-2025-66568](https://startwithidentity.com/cves/cve-2025-66568/) are that pair. Fixed in ruby-saml 1.18.1.

## Why it matters

A year of "we patched ruby-saml" tickets was not enough. Anyone who stopped at 1.12.4 stayed exposed through the 2025 holiday change freeze, which is exactly when identity incidents are hardest to staff.

## What to do

- Pin ruby-saml >= 1.18.1. Reject 1.12.4 as "patched" in any SBOM or Dependabot baseline.
- If GitLab, omniauth-saml, or an internal Rails SP was on the 1.12 line in December 2025, assume the ACS was exploitable and review admin SSO logs for unexpected first-time NameIDs.
- Read the [SAML 2.0 deep dive](https://startwithidentity.com/standards/saml-2-0/) pitfalls section before you write the next custom verifier.

## After you patch

A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.

- **Revoke every session** issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- **Audit administrative accounts and group memberships** for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- **Rotate the identity provider signing certificate** if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- **Check your own implementation for the same class**: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See [SAML 2.0](https://startwithidentity.com/standards/saml-2-0/) and [SAML vs OIDC](https://startwithidentity.com/guides/fundamentals/saml-vs-oidc/).

## Sources

- [NVD: CVE-2025-66567](https://nvd.nist.gov/vuln/detail/CVE-2025-66567)
- PortSwigger, "The Fragile Lock" (8 December 2025)