Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of…
Priority LOW 25CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
Why it matters now
EPSS 0.00765 55th percentileScored 2026-11-07
Fix Fixed json-jwt (RubyGems): 1.9.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | json-jwt (RubyGems) | 0.5.1 to before 1.9.4 | 1.9.4 | Patch available | GHSA-mj4x-wcxf-hm8x |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- json-jwt (RubyGems) Vendor— Affected 0.5.1 to before 1.9.4 Fixed in 1.9.4 Patch available GHSA-mj4x-wcxf-hm8x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:json-jwt_project:json-jwt:*:*:*:*:*:*:*:* | 0.5.0 to before 1.9.4 | Vulnerable | Json-jwt Project |
- cpe:2.3:a:json-jwt_project:json-jwt:*:*:*:*:*:*:*:* Versions 0.5.0 to before 1.9.4 Vulnerable ·Json-jwt Project
Remediation
- Fix · GHSA-mj4x-wcxf-hm8x json-jwt (RubyGems) Fixed in 1.9.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000539
- 2026-10-03 Alias added: GHSA-mj4x-wcxf-hm8x
References
Advisory 3
More Json-jwt Project Json-jwt vulnerabilities
- TI-2023-28402 The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity… CVSS 3.1HIGH 8.4
- TI-2019-13583 The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. CVSS 3.1HIGH 7.5
Sources
- CVE-2018-1000539 · CVE Program
- CVE-2018-1000539 · NVD
- FIRST EPSS
- GHSA-mj4x-wcxf-hm8x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences