CVE-2026-45363
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.24%
- CWE
- CWE-287, CWE-326, CWE-1391
- Published
- 2026-07-14
- Last modified
- 2026-07-15
Affected products
- jwt ruby-jwt
- jwt ruby-jwt
Weakness type
Related vulnerabilities
- CVE-2026-82107 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-88018 — rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-88007 — Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88895 — CyberPanel before 3.0.5 Authentication Bypass via API
- CVE-2026-87924 — Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
- CVE-2026-87922 — Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
- CVE-2026-87016 — Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator