Summary
It was discovered that ruby-jwt incorrectly verified HMAC signatures when
the verification key was empty or missing. A remote attacker could possibly
use this issue to forge tokens and bypass authentication.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | ruby-jwt | 2.7.1-1+deb13u1build0.24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | ruby-jwt | 2.7.1-1+deb13u1build0.26.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ruby-jwt | 1.0.0-3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ruby-jwt | 1.5.6-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ruby-jwt | 2.1.0-2ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ruby-jwt | 2.2.2-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.1
`jwt` (Ruby gem) - empty-key HMAC bypass
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid di…
References
-
report
https://ubuntu.com/security/CVE-2026-45363