Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-45363: ruby-jwt allows forged tokens with empty secret
CVE-2026-45363 · published 2 months ago
Summary
Older versions of the ruby-jwt library will accept authentication tokens even when the secret key is missing or empty, letting an attacker create their own valid tokens. This can let unauthorized users gain access to systems that rely on these tokens for login or permission checks. Upgrade to ruby-jwt version 2.10.3 or later (or 3.2.0 or later) to close the gap.
What to do
- Update debian ruby-jwt to version 3.2.0-1.
- Update tim rudat jwt to version 3.2.0.
- Update debian ruby-jwt to version 2.5.0-1+deb12u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | ruby-jwt | All versions |
| Debian:14 | debian | ruby-jwt |
< 3.2.0-1 Fix: upgrade to 3.2.0-1
|
| rubygems | tim rudat | jwt |
< 3.2.0 Fix: upgrade to 3.2.0
|
| – | jwt | ruby-jwt | < 2.10.3 |
| Debian:11 | debian | ruby-jwt | All versions |
| Debian:12 | debian | ruby-jwt |
< 2.5.0-1+deb12u1 Fix: upgrade to 2.5.0-1+deb12u1
|
Original advisory text
`jwt` (Ruby gem) - empty-key HMAC bypass
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
References
- https://github.com/advisories/GHSA-c32j-vqhx-rx3x
- https://security-tracker.debian.org/tracker/CVE-2026-45363 Vendor Advisory
- https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x Vendor Advisory
- https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964 Patch
- https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f Patch
- https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3 URL
- https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0 URL
- https://lists.debian.org/debian-lts-announce/2026/09/msg00022.html URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45363... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45363 Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 7.4 (GHSA)
CVSS 3.1: 9.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-287Improper Authentication
CWE-326Inadequate Encryption Strength
CWE-1391Use of Weak Credentials
Timeline
Published14 Jul 2026
Updated27 Sep 2026
First seen18 May 2026
Sources
GHSA-c32j-vqhx-rx3x · GHSA
CVE-2026-45363 · NVD
CVE-2026-45363 · MITRE
DEBIAN-CVE-2026-45363 · OSV
CVE-2026-45363 · OSV
Track software like this
Free during beta