GitHub Advisoryadvisory · Packagist

GHSA-5j8p-438x-rgg5 SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

CRITICAL Published 2025-12-09 Modified 2025-12-09 Official page ↗
Ecosystem
Packagist
Packages
onelogin/php-saml
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-1395
Reviewed
2025-12-09

Affected packages

• Packagist onelogin/php-saml: < 2.21.1 → fixed in 2.21.1 • Packagist onelogin/php-saml: >= 3.0.0, < 3.8.1 → fixed in 3.8.1 • Packagist onelogin/php-saml: >= 4.0.0, < 4.3.1 → fixed in 4.3.1

Description

Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: • 2.21.1 • 3.8.1 • 4.3.1 Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References