Start with Identity
Subscribe
Identity CVE · SAML

CVE-2025-66568ruby-saml second Fragile Lock bypass

critical
Product: ruby-samlVendor: SAML-ToolkitsCWE-347Disclosed: 2025-12-08Status: PatchedProtocol deep diveNVD ↗

What broke

CVE-2025-66568 is the second of the two PortSwigger "Fragile Lock" ruby-saml bypasses disclosed on 8 December 2025. It affects ruby-saml below 1.18.0, including the earlier "patched" 1.12.4 line. Fixed in 1.18.1.

Why it matters

Same blast radius as CVE-2025-66567: any user, including admins, on any SP still verifying SAML with that library. Two IDs exist because there were two distinct remaining paths, not because one is theoretical.

What to do

  • Upgrade once, to 1.18.1 or later, and close both tickets together.
  • Rotate IdP signing material if the SP was internet-reachable on a vulnerable build.
  • Stop treating each ruby-saml CVE as a separate risk acceptance. Track the library version as the control.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.