Skip to content
OpenAdvisories

Package · Ubuntu

ruby-jwt

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.1
    CVE-2026-45363

    `jwt` (Ruby gem) - empty-key HMAC bypass

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid di…

    jwt ruby-jwt ruby-jwt ruby-jwt Debian Ubuntu RubyGems
  • Critical 9.1
    CVE-2025-45765

    ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not so…

    ruby-jwt ruby-jwt Debian Ubuntu