`jwt` (Ruby gem) - empty-key HMAC bypass
Priority MEDIUM 47CWE-1391Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 5 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287 and CWE-326.
Summary
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-07
Fix Partial ruby-jwt (jwt): 2.10.3, 3.2.0jwt (RubyGems): 3.2.0, 2.10.3Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jwt | ruby-jwt | before 2.10.3; 3.0.0 to before 3.2.0 | 2.10.3, 3.2.0 | Patch available | CNA |
| — | jwt (RubyGems) | 3.0.0 to before 3.2.0 | 3.2.0 | Patch available | GHSA-c32j-vqhx-rx3x |
| — | jwt (RubyGems) | before 2.10.3 | 2.10.3 | Patch available | GHSA-c32j-vqhx-rx3x |
- ruby-jwt Vendorjwt Affected before 2.10.3; 3.0.0 to before 3.2.0 Fixed in 2.10.3, 3.2.0 Patch available CNA
- jwt (RubyGems) Vendor— Affected 3.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-c32j-vqhx-rx3x
- jwt (RubyGems) Vendor— Affected before 2.10.3 Fixed in 2.10.3 Patch available GHSA-c32j-vqhx-rx3x
Remediation
- Fix · CNA ruby-jwt (jwt) Fixed in 2.10.3, 3.2.0
- Fix · GHSA-c32j-vqhx-rx3x jwt (RubyGems) Fixed in 3.2.0 Advisory →
- Fix · GHSA-c32j-vqhx-rx3x jwt (RubyGems) Fixed in 2.10.3 Advisory →
Red Hat 4 advisories
- RHSA-2026:63327 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.16.13 Async Update
- Red Hat Satellite 6.16 for RHEL 8 openvox-server-8.15.2-1.el8sat, python-aiohttp-3.14.3-1.el8pc, python3.11-aiohttp-3.14.3-1.el8pc +1
- Red Hat Satellite 6.16 for RHEL 9 openvox-server-8.15.2-1.el9sat, python-aiohttp-3.14.3-1.el9pc, python3.11-aiohttp-3.14.3-1.el9pc +1
- RHSA-2026:63385 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.19.4 Async Update
- Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
- RHSA-2026:63387 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.17.11 Async Update
- Red Hat Satellite 6.17 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
Show 1 more Red Hat advisories
- RHSA-2026:63386 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.18.9 Async Update
- Red Hat Satellite 6.18 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:63327 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:63327 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:63387 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:63386 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:63385 |
Not affected: 7 products
- Red Hat 3scale API Management Platform 2
- Red Hat Hardened Images
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45363
- 2026-10-03 Alias added: GHSA-c32j-vqhx-rx3x
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-18 Affected versions changed · Red Hat
- 2026-10-29 Affected versions changed · Red Hat
References
Other 9
- https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x
- https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964
- https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
- https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3
- https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0
- https://github.com/jwt/ruby-jwt/issues/724
- https://github.com/jwt/ruby-jwt
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jwt/CVE-2026-45363.yml
- https://www.cve.org/CVERecord?id=CVE-2026-45363
More jwt vulnerabilities
- TI-2025-34621 jwe: Missing AES-GCM authentication tag validation in encrypted JWEs CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-45363 · CVE Program
- CVE-2026-45363 · NVD
- FIRST EPSS
- GHSA-c32j-vqhx-rx3x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-45363 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences