Start with Identity
Subscribe
Identity CVE · SAML

CVE-2025-66567ruby-saml bypass after 1.12.4, PortSwigger Fragile Lock

critical
Product: ruby-samlVendor: SAML-ToolkitsCWE-347Disclosed: 2025-12-08Status: PatchedProtocol deep diveNVD ↗

What broke

PortSwigger's December 2025 research, "The Fragile Lock," showed that ruby-saml versions below 1.18.0, including 1.12.4 (the first patched line for the March bugs), still accepted forged SAML assertions. CVE-2025-66567 and CVE-2025-66568 are that pair. Fixed in ruby-saml 1.18.1.

Why it matters

A year of "we patched ruby-saml" tickets was not enough. Anyone who stopped at 1.12.4 stayed exposed through the 2025 holiday change freeze, which is exactly when identity incidents are hardest to staff.

What to do

  • Pin ruby-saml >= 1.18.1. Reject 1.12.4 as "patched" in any SBOM or Dependabot baseline.
  • If GitLab, omniauth-saml, or an internal Rails SP was on the 1.12 line in December 2025, assume the ACS was exploitable and review admin SSO logs for unexpected first-time NameIDs.
  • Read the SAML 2.0 deep dive pitfalls section before you write the next custom verifier.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.