High, CVSS 7.4RubyGemsPublished
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
CVE-2026-45363 · GHSA-c32j-vqhx-rx3x
- Affected
- RubyGems jwt >= 3.0.0, < 3.2.0; < 2.10.3
- Fixed in
- 3.2.02.10.3· Vendor fix available
- Issue
- JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token. OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key, and no raise InvalidKeyError if key.empty? precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or keyfinder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#findkey only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signingkey ||= '') before signing. Common application patterns that produce the unsafe value: redis.get("kid:#{kid}").tos, ORM string columns with default: '', ENV['SECRET'] || '', Hash.new('') lookups, [primary, fallback] where fallback may be nil. Applications passing a non-empty static key:, or whose keyfinder returns nil / raises on miss, are not affected. The existing enforcehmackeylength option would block this but defaults to false. On OpenSSL ≥ 3.5 the empty-key HMAC.digest call no…
Recommended action: Upgrade to 3.2.0 or 2.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.