jwt up to 2.10.2/3.1.x HMAC Verifier decode key risky encryption

Summaryinfo

A vulnerability, which was classified as problematic, was found in jwt up to 2.10.2/3.1.x. The affected element is the function decode of the component HMAC Verifier. Executing a manipulation of the argument key can lead to risky encryption. This vulnerability is handled as CVE-2026-45363. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in jwt up to 2.10.2/3.1.x and classified as problematic. This vulnerability affects the function decode of the component HMAC Verifier. The manipulation of the argument key with an unknown input leads to a risky encryption vulnerability. The CWE definition for the vulnerability is CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. As an impact it is known to affect confidentiality. CVE summarizes:

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.

The advisory is available at github.com. This vulnerability was named CVE-2026-45363 since 05/12/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 2.10.3 or 3.2.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• jwt

Version

• 2.10.0
• 2.10.1
• 2.10.2
• 3.0
• 3.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion