GHSA-5j8p-438x-rgg5
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
GHSA-5j8p-438x-rgg5 is a critical vulnerability (CVSS 9.3) in onelogin/php-saml, published December 9, 2025. No source lists public exploit code. Fixed in onelogin/php-saml 2.21.1.
- Severity
- 9.3 CriticalCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.21.1onelogin/php-saml +5 more
Description
Summary
There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
onelogin/php-samlPackagist | before 2.21.1 | 2.21.1 |
onelogin/php-samlPackagist | 3.0.0 up to 3.8.1 | 3.8.1 |
onelogin/php-samlPackagist | 4.0.0 up to 4.3.1 | 4.3.1 |
onelogin/php-samlPackagist | before 2.21.1, plus listed versions 2.0.02.1.02.10.02.10.12.10.2 Show 28 moreShow less2.10.32.10.42.10.52.10.62.10.72.11.02.16.02.17.02.17.12.18.02.18.12.19.02.19.12.20.02.21.02.3.02.4.02.5.02.6.02.6.12.7.02.8.02.9.02.9.1v2.12.0v2.13.0v2.14.0v2.15.0 | 2.21.1 |
onelogin/php-samlPackagist | 3.0.0 up to 3.8.1, plus listed versions 3.1.13.2.03.2.13.3.03.3.1 Show 10 moreShow less3.4.03.4.13.5.03.5.13.6.03.6.13.7.03.8.0v3.0.0v3.1.0 | 3.8.1 |
onelogin/php-samlPackagist | 4.0.0 up to 4.3.1, plus listed versions 4.0.14.1.04.2.04.3.0 | 4.3.1 |
What each source reports
GitHub Advisories Score used
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Summary
There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
- Record
GHSA-5j8p-438x-rgg5- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-1395
- Updated
- 2026-11-02
OSV
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Summary
There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
- Record
GHSA-5j8p-438x-rgg5- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-1395
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/SAML-Toolkits/php-saml/security/advisories/GHSA-5j8p-438x-rgg5