Skip to content
OpenAdvisories

Product · jwt

ruby-jwe

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2025-54887 Public exploit

    jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

    jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbit…

    jwt ruby-jwe jwe RubyGems