Security Digest · Critical advisory (no CVE assigned)
GHSA-5j8p-438x-rgg5: SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: - 2.21.1 - 3.8.1 - 4.3.1 Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate…
CVSS 9.3 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | onelogin/php-saml | < 2.21.1 | 2.21.1 |
| Composer (PHP) | onelogin/php-saml | >= 3.0.0, < 3.8.1 | 3.8.1 |
| Composer (PHP) | onelogin/php-saml | >= 4.0.0, < 4.3.1 | 4.3.1 |
Details
Summary
There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: - 2.21.1 - 3.8.1 - 4.3.1
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Sources and references
- GitHub Advisory GHSA-5j8p-438x-rgg5 github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest