From b39c171d96d1d51d454c8b939f89f5b274f6893f Mon Sep 17 00:00:00 2001
From: Tim van Dijen <tvdijen@gmail.com>
Date: Thu, 13 Aug 2026 21:30:15 +0200
Subject: [PATCH 1/2] Fix confusion of the root-node when validating a
 signature

---
 src/XML/saml/Assertion.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/XML/saml/Assertion.php b/src/XML/saml/Assertion.php
index c1a9d37d8..997f480a7 100644
--- a/src/XML/saml/Assertion.php
+++ b/src/XML/saml/Assertion.php
@@ -17,6 +17,7 @@
 use SimpleSAML\SAML2\XML\EncryptableElementTrait;
 use SimpleSAML\SAML2\XML\SignableElementTrait;
 use SimpleSAML\SAML2\XML\SignedElementTrait;
+use SimpleSAML\XML\DOMDocumentFactory;
 use SimpleSAML\XML\SchemaValidatableElementInterface;
 use SimpleSAML\XML\SchemaValidatableElementTrait;
 use SimpleSAML\XMLSchema\Exception\InvalidDOMElementException;
@@ -326,7 +327,10 @@ public static function fromXML(Dom\Element $xml): static
         if (!empty($signature)) {
             $assertion->setSignature($signature[0]);
             $assertion->wasSignedAtConstruction = true;
-            $assertion->setXML($xml);
+
+            $doc = DOMDocumentFactory::create();
+            $doc->appendChild($doc->importNode($xml, true));
+            $assertion->setXML($doc->documentElement);
         }
 
         return $assertion;

From b70f84ba910c8d0205caf83319552e4bc3b8c87a Mon Sep 17 00:00:00 2001
From: Tim van Dijen <tvdijen@gmail.com>
Date: Sat, 15 Aug 2026 15:26:19 +0200
Subject: [PATCH 2/2] No-op:  improve comments and method name

---
 .../GoldenSAMLResponseTest.php                | 31 ++++++++++++-------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/tests/Vulnerabilities/GoldenSAMLResponseTest.php b/tests/Vulnerabilities/GoldenSAMLResponseTest.php
index 08ad1b500..dd2e976ca 100644
--- a/tests/Vulnerabilities/GoldenSAMLResponseTest.php
+++ b/tests/Vulnerabilities/GoldenSAMLResponseTest.php
@@ -16,16 +16,19 @@
 use function dirname;
 
 /**
- * CVE-2025-66475
- *
  * @package simplesamlphp/saml2
  */
 #[Group('vulnerabilities')]
 final class GoldenSAMLResponseTest extends TestCase
 {
     /**
+     * CVE-2025-66475 / Void Canonicalization ("Golden SAML Response")
+     *
+     * A relative namespace on an ancestor causes libxml2 C14N to fail.
+     * After the fix this must be treated as fatal; the signature must not
+     * be accepted (even though DigestValue is the SHA-256 of the empty string).
      */
-    public function testSignedResponseWithStrayXmlnsThrowsAnException(): void
+    public function testGoldenSAMLResponseWithRelativeXmlnsIsRejected(): void
     {
         $doc = DOMDocumentFactory::fromFile(
             dirname(__DIR__, 1) . '/resources/xml/vulnerabilities/CVE-2025-66475.xml',
@@ -33,23 +36,27 @@ public function testSignedResponseWithStrayXmlnsThrowsAnException(): void
 
         $response = Response::fromXML($doc->documentElement);
         $assertion = $response->getAssertions()[0];
-        /** @var \SimpleSAML\XMLSecurity\XML\ds\X509Data $data */
-        $data = $assertion->getSignature()->getKeyInfo()->getInfo()[0];
+
+        // Key material taken from the Signature in the fixture
+        /** @var \SimpleSAML\XMLSecurity\XML\ds\X509Data $x509Data */
+        $x509Data = $assertion->getSignature()->getKeyInfo()->getInfo()[0];
+        $cert = $x509Data->getData()[0]->getContent()->getValue();
+
+        $alg = $assertion->getSignature()
+            ->getSignedInfo()
+            ->getSignatureMethod()
+            ->getAlgorithm()
+            ->getValue();
 
         $verifier = (new SignatureAlgorithmFactory())->getAlgorithm(
-            $assertion->getSignature()->getSignedInfo()->getSignatureMethod()->getAlgorithm()->getValue(),
+            $alg,
             new PublicKey(
-                new PEM(
-                    PEM::TYPE_PUBLIC_KEY,
-                    $data->getData()[0]->getContent()->getValue(),
-                ),
+                new PEM(PEM::TYPE_PUBLIC_KEY, $cert),
             ),
         );
 
         $this->expectException(CanonicalizationFailedException::class);
 
-        // When PHP 8.5 becomes the minimum:
-        // (void)@$assertion->verify($verifier);
         @$assertion->verify($verifier);
     }
 }