SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Date: 2025-12
Affected: composer/onelogin/php-saml, composer/onelogin/php-saml, composer/onelogin/php-saml
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-66578
CWE: CWE-1395
CWE-248
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L)

**Summary** There is a critical vulnerability on xmlseclibs [CVE-2025-66475](https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9), a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: - [2.21.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/2.21.1) - [3.8.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/3.8.1) - [4.3.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.1) **Impact** Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.


Mitigations:

Architectural layers (MAESTRO):