SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

CRITICALGHSA-5j8p-438x-rgg5 · Published 09/12/2025 · updated 09/12/2025

In short

Package	Affected versions	Patched versions
onelogin/php-saml Packagist	`≥ 3.0.0, < 3.8.1≥ 4.0.0, < 4.3.1< 2.21.1`	`3.8.14.3.12.21.1`

Summary

There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml

Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:

Impact

Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.