{"action":"Upgrade ruby-saml to 1.18.0 or later.","affected":[{"fixed":"1.18.0","introduced":"0"}],"component":"ruby-saml","cve_ids":["CVE-2025-66567"],"ecosystem":"RubyGems","epss":0.00417,"exploited":false,"fixed_versions":["1.18.0"],"ghsa_id":"GHSA-9v8j-x534-2fx3","id":"tcs_01M5KEJHC4YVMMFW9735H6JP81","modified_at":"2026-02-04T02:32:35.929310Z","published_at":"2025-12-08T21:30:56Z","references":["https://osv.dev/vulnerability/GHSA-9v8j-x534-2fx3","https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3","https://nvd.nist.gov/vuln/detail/CVE-2025-66567","https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97","https://github.com/SAML-Toolkits/ruby-saml","https://github.com/advisories/GHSA-754f-8gm6-c4r2","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-66567.yml"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-9v8j-x534-2fx3","url":"https://osv.dev/vulnerability/GHSA-9v8j-x534-2fx3"},{"source":"nvd","source_id":"CVE-2025-66567","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66567"}],"summary":"Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)"}