Skip to content
OpenAdvisories

Product · jwt

ruby-jwt

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-45363

    `jwt` (Ruby gem) - empty-key HMAC bypass

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid di…

    jwt ruby-jwt ruby-jwt ruby-jwt Debian Ubuntu RubyGems