Skip to content
OpenAdvisories

Vendor

jwt

2 known vulnerabilities.

Products

ruby-jwt 1 ruby-jwe 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-45363

    `jwt` (Ruby gem) - empty-key HMAC bypass

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid di…

    jwt ruby-jwt kube-fluentd-operator ruby3.4-kube-logging-operator-fluentd-outputs Debian Ubuntu Wolfi RubyGems
  • Critical 9.1
    CVE-2025-54887 Public exploit

    jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

    jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbit…

    jwt ruby-jwe jwe RubyGems