CVE-2026-45363 jwt CVE debrief

Who should care

Defenders responsible for Ruby applications using the ruby-jwt library, particularly those handling JSON Web Tokens (JWT) for authentication or authorization, should assess exposure and prioritize updates.

Why it matters

CVE-2026-45363 in ruby-jwt allows forged tokens due to empty key verification issue, requiring defenders to verify and update to patched versions, assess exposure, and monitor for potential issues.

• Potential token verification bypass
• Possible authentication or authorization issues
• Need for verification of affected systems and applications

Technical summary

The ruby-jwt library prior to versions 2.10.3 and 3.2.0 contains a vulnerability where JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token due to OpenSSL::HMAC.digest('SHA256', '', payload) returning a valid digest under an empty key. This vulnerability affects HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. The issue is fixed in versions 2.10.3 and 3.2.0, which introduce proper key verification checks to prevent such bypasses. Defenders should prioritize verifying and updating ruby-jwt to versions 2.10.3 or 3.2.0.

Defensive priority

Defenders should prioritize verifying and updating ruby-jwt to versions 2.10.3 or 3.2.0, and review systems using affected versions for potential exposure.

Recommended defensive actions

• Verify and update ruby-jwt to versions 2.10.3 or 3.2.0
• Review systems using affected ruby-jwt versions for potential exposure
• Monitor for and respond to potential token verification issues
• Perform thorough vulnerability assessment
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. GitHub commits and releases offer patch information for versions 2.10.3 and 3.2.0. The vulnerability allows for token verification bypass, potentially leading to authentication or authorization issues. Defenders should verify and update ruby-jwt to versions 2.10.3 or 3.2.0 and review systems using affected versions for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.