THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-45363 (CRITICAL 9.1) — ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty k

[NVD] CVE-2026-45363 (CRITICAL 9.1) — ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty k

lownvdPublished 2026-07-14

CVE-2026-45363 CVSS: 9.1 CRITICAL Published: 2026-07-14T22:16:54.463

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMA

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-45363