CVE-2025-66578
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
xmlseclibs version 3.1.3 contains an authentication bypass vulnerability caused by a flaw in the libxml2 canonicalization process during document transformation. When libxml2 canonicalization is invoked on invalid XML input, it may return an empty string instead of a canonicalized node, and xmlseclibs computes the DigestValue over this empty string, treating it as a successful canonicalization.
Risk Assessment
An attacker may bypass XML signature verification and authentication, potentially leading to unauthorized access to protected resources or impersonation of a trusted sender. The vulnerability affects systems using xmlseclibs for XML signature validation.
Recommendation
Update xmlseclibs to version 3.1.4. As a workaround, treat canonicalization failures (exceptions or nil/empty outputs) as fatal and abort validation, and add explicit checks to reject when canonicalization returns nil/empty or raises errors.
Related vulnerabilities
- CVE-2026-96207Critical
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-94510Critical
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-88131Critical
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
- CVE-2026-77900Critical
Missing authentication for a critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-69435Critical
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- CVE-2026-84249Critical
IBM Guardium Data Protection 12.2 and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for a critical function.
- CVE-2026-80381Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
- CVE-2026-75875Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
- CVE-2026-107726Critical
Hazelcast prior to 5.4.5, 5.5.10, and 5.6.1 contains improper validation of data supplied by a malicious client able to connect to a cluster, allowing arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
- CVE-2026-107722Critical
fast-jwt from 6.2.0 until 6.3.0 can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.
Original NVD description (English source)
xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Versions 3.1.3 contain an authentication bypass vulnerability due to a flaw in the libxml2 canonicalization process during document transformation. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. xmlseclibs then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 3.1.4. Workarounds include treating canonicalization failures (exceptions or nil/empty outputs) as fatal and aborting validation, and/or adding explicit checks to reject when canonicalize returns nil/empty or raises errors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS