Approved changes feed: RSS · Atom
cpe:2.3:a:jwt:ruby-jwt:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jwt (baeda3dc-0133-5972-a564-7885f79f5452) |
|---|---|
| Product | Ruby Jwt (af4b4f68-5019-5b64-8a93-62772684e6a4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45363 |
vulnerable | 2026-07-29 00:52:15.335087 |
`jwt` (Ruby gem) - empty-key HMAC bypass
CRITICAL (9.1)
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
Published: 2026-07-14T21:32:26.676Z
Updated: 2026-09-19T18:07:54.033Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.