Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-14T21:32:26 ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-347

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC (Hash-based Message Authentication Code) digest calculation during token verification. This allows the attacker to bypass authentication and integrity checks, potentially leading to unauthorized access or data manipulation.

Red Hat Hardened Images Affected chunkah Red Hat Satellite 6 Affected rubygem-jwt Red Hat Satellite 6 Affected satellite-capsule:el8/rubygem-jwt https://www.cve.org/CVERecord?id=CVE-2026-45363 https://nvd.nist.gov/vuln/detail/CVE-2026-45363 https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964 https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3 https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0 https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x