HMAC Vulnerability in Ruby Implementation of OAuth JSON Web Token Standard
CVE-2026-45363
9.1CRITICAL
What is CVE-2026-45363?
The ruby-jwt library, used for implementing OAuth JSON Web Token standards, has a vulnerability that allows exploitation via token forgery. Specifically, the JWT.decode method, when used with an empty key, may return a valid digest, compromising the security of token verification for algorithms HS256, HS384, and HS512. Attackers may exploit this flaw by crafting fraudulent tokens, as no precondition exists to enforce key usage in certain scenarios. The issue has been addressed in the updates released in versions 2.10.3 and 3.2.0, which mitigate the risk of unauthorized token acceptance.
Affected Version(s)
ruby-jwt < 2.10.3 < 2.10.3
ruby-jwt >= 3.0.0, < 3.2.0 < 3.0.0, 3.2.0