Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M
CVE-2025-66578robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation
Medium 6.0
In plain English
A medium-severity security flaw in xmlseclibs from robrichards. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Versions 3.1.3 contain an authentication bypass vulnerability due to a flaw in the libxml2 canonicalization process during document transformation. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. xmlseclibs then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 3.1.4. Workarounds include treating canonicalization failures (exceptions or nil/empty outputs) as fatal and aborting validation, and/or adding explicit checks to reject when canonicalize returns nil/empty or raises errors.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | robrichards/xmlseclibs | 3.1.4 | GHSA-c4cc-x928-vjw9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| robrichards | xmlseclibs | < 3.1.4 |
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
References
- https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9 x_refsource_CONFIRM
- https://github.com/robrichards/xmlseclibs/commit/69fd63080bc47a8d51bc101c30b7cb756862d1d6 x_refsource_MISC
- https://github.com/robrichards/xmlseclibs/blob/f4131320c6dcd460f1b0c67f16f8bf24ce4b5c3e/src/XMLSecurityDSig.php#L296 x_refsource_MISC