jwt up to 2.10.2/3.1.x HMAC Verifier decode key risky encryption

Summaryinfo

A vulnerability, which was classified as problematic, was found in jwt up to 2.10.2/3.1.x. The affected element is the function decode of the component HMAC Verifier. Executing a manipulation of the argument key can lead to risky encryption. This vulnerability is handled as CVE-2026-45363. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in jwt up to 2.10.2/3.1.x and classified as problematic. This vulnerability affects the function decode of the component HMAC Verifier. The manipulation of the argument key with an unknown input leads to a risky encryption vulnerability. The CWE definition for the vulnerability is CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. As an impact it is known to affect confidentiality. CVE summarizes:

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.

The advisory is available at github.com. This vulnerability was named CVE-2026-45363 since 05/12/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 327193 (Linux Distros Unpatched Vulnerability : CVE-2026-45363), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.10.3 or 3.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (327193). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• jwt

Version

• 2.10.0
• 2.10.1
• 2.10.2
• 3.0
• 3.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion