GHSA-5j8p-438x-rgg5: SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: - 2.21.1 - 3.8.1 - 4.3.1 Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Published Dec 9, 2025
Affected packages
onelogin/php-saml
- Ecosystem
- Composer (PHP)
- Affected
- < 2.21.1
- Fixed in
- 2.21.1
- Check
composer show onelogin/php-saml
onelogin/php-saml
- Ecosystem
- Composer (PHP)
- Affected
- >= 3.0.0, < 3.8.1
- Fixed in
- 3.8.1
- Check
composer show onelogin/php-saml
onelogin/php-saml
- Ecosystem
- Composer (PHP)
- Affected
- >= 4.0.0, < 4.3.1
- Fixed in
- 4.3.1
- Check
composer show onelogin/php-saml
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Credited to d0ge.
References
- https://github.com/SAML-Toolkits/php-saml/security/advisories/GHSA-5j8p-438x-rgg5
- https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9
- https://github.com/SAML-Toolkits/php-saml/releases/tag/2.21.1
- https://github.com/SAML-Toolkits/php-saml/releases/tag/3.8.1
- https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.1
- https://github.com/advisories/GHSA-5j8p-438x-rgg5
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology