OneLogin SAML SSO < 3.6.0 – Authentication Bypass / Admin Account Takeover | CVE 2025-66475

Description

The plugin does not correctly validate the signature of SAML assertions, due to a vulnerability in the bundled xmlseclibs library (CVE-2025-66475), allowing unauthenticated attackers to forge an assertion and log in as an administrator. The issue was supposed to be fixed in 3.5.0 however the plugin did not bump the version and stayed at 3.4.0

Proof of Concept

1. Obtain the target's IdP signing certificate (public — exposed in SAML IdP metadata) to embed in <ds:X509Certificate>.

2. Craft a SAML Response/Assertion asserting administrator access, e.g.:
    - <saml:NameID> / User.email / User.Username = attacker-chosen identity
    - memberOf = Administrator (or whatever the plugin's role-mapping grants admin)

3. Apply the CVE-2025-66475 canonicalization technique so xmlseclibs validates the signature/digest despite the assertion not being signed by the IdP's private key (see published PoCs in references).

4. Base64-encode and POST it:
  POST /wp-login.php?saml_acs HTTP/1.1
  Host: <target>
  Content-Type: application/x-www-form-urlencoded

  RelayState=https://<target>/wp-login.php&SAMLResponse=<base64-of-forged-response>

5. The plugin accepts the assertion and provisions/authenticates the attacker as administrator.