CVE-2026-45363 `jwt` (Ruby gem) - empty-key HMAC bypass
Attackers can forge valid JWT tokens by exploiting empty-key HMAC verification flaws in the ruby-jwt library, bypassing authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45363?
CVE-2026-45363 is a critical authentication bypass vulnerability in ruby-jwt, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
Which versions are affected by CVE-2026-45363?
4 open source packages ship an affected version, including jwt.
| Package | Affected | Fixed in |
|---|---|---|
jwt RubyGems | All versions | 2.10.3 |
jwt RubyGems | All versions | 2.10.3 |
jwt RubyGems | From 3.0.0 | 3.2.0 |
jwt RubyGems | From 3.0.0 | 3.2.0 |
How do I fix CVE-2026-45363?
Upgrade jwt to a fixed version for your release line: 2.10.3 or 3.2.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-45363 being exploited?
There is no known exploitation of CVE-2026-45363 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-45363, GHSA-c32j-vqhx-rx3x, MINI-4rmj-7r6x-82rp, MINI-9mmf-hm45-p85q, MINI-9w58-pgcp-fc4j, UBUNTU-CVE-2026-45363.