---
title: "GHSA-5j8p-438x-rgg5: SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475"
url: https://erroneo.us/security/ghsa/GHSA-5j8p-438x-rgg5/
description: "GHSA-5j8p-438x-rgg5 (critical, Composer (PHP)): SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475. Summary There is a critical vulnerability on…"
type: advisory
section: "Security Digest"
date_published: 2025-12-09
date_modified: 2025-12-09
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-5j8p-438x-rgg5"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-5j8p-438x-rgg5: SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

## Affected packages

- Composer (PHP) `onelogin/php-saml` < 2.21.1 → fixed: 2.21.1
- Composer (PHP) `onelogin/php-saml` >= 3.0.0, < 3.8.1 → fixed: 3.8.1
- Composer (PHP) `onelogin/php-saml` >= 4.0.0, < 4.3.1 → fixed: 4.3.1

## Details

Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: - 2.21.1 - 3.8.1 - 4.3.1 Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.

## Sources

- [GitHub Advisory GHSA-5j8p-438x-rgg5](https://github.com/advisories/GHSA-5j8p-438x-rgg5)
- [github.com](https://github.com/SAML-Toolkits/php-saml/security/advisories/GHSA-5j8p-438x-rgg5)
- [github.com](https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9)
- [github.com](https://github.com/SAML-Toolkits/php-saml/releases/tag/2.21.1)
- [github.com](https://github.com/SAML-Toolkits/php-saml/releases/tag/3.8.1)
- [github.com](https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.1)

---
Source page: https://erroneo.us/security/ghsa/GHSA-5j8p-438x-rgg5/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt