CVE-2026-45363 Details
Description
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
A vulnerability exists in ruby-jwt versions prior to 2.10.3 and 3.2.0, allowing the decoding of attacker-forged tokens using the HMAC algorithm (HS256, HS384, HS512) without a valid secret key. This issue arises because OpenSSL's HMAC function accepts empty keys, and the library does not enforce key validity before verification. The vulnerability can be exploited through the JWT.decode method or by using a keyfinder that returns an empty value, bypassing normal key validation.
Users can upgrade to ruby-jwt versions 2.10.3 or 3.2.0, both of which include the necessary fix. Instructions for downloading these versions are available on the GitHub Releases page for the ruby-jwt repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2026/09/msg00022.html | CVE | |
| https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964 | [email protected] | Source CodeVendor |
| https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f | [email protected] | Source CodeVendor |
| https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3 | [email protected] | Release NotesVendor |
| https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0 | [email protected] | Release NotesVendor |
| https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1391 | Use of Weak Credentials | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-326 | Inadequate Encryption Strength | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruby-jwt | >= 3.0.0, < 3.2.0 (semver) < 2.10.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | [email protected] |
| Sep 19, 2026 | CVE Modified | CVE |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |