CVE-2026-45363

Description

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 16%

Techniques & Countermeasures

• CWE-287•Improper Authentication

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

• CWE-326•Inadequate Encryption Strength

  The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

• CWE-1391•Use of Weak Credentials

  The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

Affected Systems

• chainguard•cinc-auditor

  < 7.1.7-r0

• chainguard•gitlab-rails-ce-18.1

  all

• chainguard•gitlab-rails-ce-18.10

  < 18.10.8-r0

• chainguard•gitlab-rails-ce-18.11

  < 18.11.5-r0

• chainguard•gitlab-rails-ce-18.3

  all

• chainguard•gitlab-rails-ce-18.4

  all

• chainguard•gitlab-rails-ce-18.5

  all

• chainguard•gitlab-rails-ce-18.6

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  < 19.0.2-r0

• chainguard•gitlab-rails-ce-fips-18.1

  all

• chainguard•gitlab-rails-ce-fips-18.10

  < 18.10.8-r0

• chainguard•gitlab-rails-ce-fips-18.11

  < 18.11.5-r0

• chainguard•gitlab-rails-ce-fips-18.3

  all

• chainguard•gitlab-rails-ce-fips-18.4

  all

• chainguard•gitlab-rails-ce-fips-18.5

  all

• chainguard•gitlab-rails-ce-fips-18.6

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  < 19.0.1-r4

• chainguard•kube-fluentd-operator

  < 1.18.2-r65

• chainguard•logstash-8.19

  < 8.19.16-r0

• chainguard•logstash-8.19-iamguarded-compat

  < 8.19.16-r0

• chainguard•logstash-8.19-with-output-opensearch

  < 8.19.16-r0

• chainguard•ruby3.2-kube-logging-operator-fluentd-outputs

  < 6.5.2-r0

• chainguard•ruby3.4-kube-logging-operator-fluentd-outputs

  < 6.5.2-r0

• wolfi•cinc-auditor

  < 7.1.7-r0

• wolfi•kube-fluentd-operator

  < 1.18.2-r65

• wolfi•ruby3.2-kube-logging-operator-fluentd-outputs

  < 6.5.2-r0

• wolfi•ruby3.4-kube-logging-operator-fluentd-outputs

  < 6.5.2-r0

• debian•ruby-jwt

  all | all | < 2.5.0-1+deb12u1 | all | < 3.2.0-1

• jwt•ruby-jwt

  < 2.10.3 | ≥ 3.0.0, < 3.2.0

References (8)

• https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x
• https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964
• https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
• https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3
• https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0
• https://security-tracker.debian.org/tracker/CVE-2026-45363
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45363.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-45363