SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
**Summary**
There is a critical vulnerability on xmlseclibs [CVE-2025-66475](https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9), a dependency of php-saml
Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
- [2.21.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/2.21.1)
- [3.8.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/3.8.1)
- [4.3.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.1)
**Impact**
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system.
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
In order to verify Signatures on Logoutrequests and LogoutResponses we use
the verifySignature of the class XMLSecurityKey from the xmlseclibs library.
That method end up calling openssl_verify() depending on the signature algorithm used.
The openssl_verify() function returns 1 when the signature was successfully verified,
0 if it failed to verify with the given key, and -1 in case an error occurs.
PHP allows translating numerical values to boolean implicitly, with the following correspondences:
- 0 equals false.
- Non-zero equals true.
This means that an implicit conversion to boolean of the values returned by openssl_verify()
will convert