The ruby-jwt library, a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard, contains an improper authentication vulnerability (CWE-287) in versions prior to 2.10.3 and 3.2.0. When decoding tokens with JWT.decode(token, '', true, algorithm: 'HS256'), the library accepts attacker-forged tokens due to OpenSSL::HMAC.digest('SHA256', '', payload) producing a valid digest with an empty key and the absence of an empty-key precondition check. This flaw also occurs when a keyfinder block or key_finder argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 signature verification paths. The vulnerability allows attackers to bypass signature verification, compromising authentication integrity. The issue is resolved in versions 2.10.3 and 3.2.0.

Successful exploitation allows attackers to forge JWT tokens that are accepted as valid by the ruby-jwt library, bypassing authentication controls. This leads to a complete compromise of authentication integrity (high confidentiality and integrity impact) without affecting availability. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

A fix is available in ruby-jwt versions 2.10.3 and 3.2.0. Users should upgrade to at least these versions to remediate the vulnerability. Since this is a cloud-hosted service library, the vendor manages remediation for cloud services using this library. Check the vendor advisory or official sources for confirmation and further guidance. No additional mitigations are specified.