jwt
A ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard.
View on Github
Activity
- Latest release
- 2d ago
- Total releases
- 57
- Cadence
- ~2 months
- Last 12 months
- 3
Reach
- Downloads
- 810.1M
- Stars
- 3.7k
Details
- License
- MIT
- First release
- Feb 23, 2011
| Version | Released | |
|---|---|---|
3.3.0
minor
| ||
2.10.3
patch
| ||
3.2.0
minor
| ||
2.10.2
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
3.1.2
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
3.1.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
3.1.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
3.0.0
major
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
3.0.0.beta1
pre
| ||
2.10.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.10.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.9.2
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.9.3
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.9.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.9.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.8.2
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.8.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.8.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.5.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.4.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.4.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.4.0.beta1
pre
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.3.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.2.3
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.2.2
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.2.2
patch
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.2.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.2.1
patch
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.2.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.2.0
minor
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.2.0.pre.beta.0
pre
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.2.0.pre.beta.0
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.1.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.1.0
minor
Dependencies (8)
Changelog
Compare changes
|
|
2.0.0
major
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.0.0
major
Dependencies (8)
Changelog
Compare changes
|
|
2.0.0.beta1
pre
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.0.0.beta1
pre
Dependencies (8)
Changelog
Compare changes
|
|
1.5.6
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.5.5
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.5.4
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.5.2
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.5.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.5.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.4.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.4.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.3.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.2.1
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.1.13
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.0.0
major
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.1.11
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.1.10
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.1.8
patch
1 CVE
CVE-2026-45363
GHSA-c32j-vqhx-rx3x
May 18, 2026
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing. Common application patterns that produce the unsafe value: The existing Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
Affected versions
3.0.0
3.1.0
3.1.1
3.1.2
0.1.1
0.1.10
0.1.11
0.1.13
0.1.2
0.1.3
0.1.4
0.1.5
+ 41 more Show less
0.1.6
0.1.7
0.1.8
1.0.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.4
1.5.5
1.5.6
2.0.0
2.0.0.beta1
2.1.0
2.10.0
2.10.1
2.10.2
2.2.0
2.2.0.pre.beta.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.0.beta1
2.4.1
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3
Fixed in
2.10.3
3.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |