jwt CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL jwt CVE published 2026-07-14

CVE-2026-45363

CVE-2026-45363 ruby-jwt vulnerability allows forged tokens due to empty key verification issue. The vulnerability exists in versions prior to 2.10.3 and 3.2.0, where JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. This is [truncated]