CVE-2026-45363: CWE-287: Improper Authentication in jwt ruby-jwt

The ruby-jwt library, implementing RFC 7519 JSON Web Tokens, improperly authenticates tokens when the HMAC key is empty or nil. Specifically, prior to versions 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts attacker-forged tokens because OpenSSL::HMAC.digest with an empty key returns a valid digest and no check prevents empty keys. This affects HS256, HS384, and HS512 algorithms and occurs when the keyfinder returns empty or nil values. The vulnerability allows bypassing signature verification, compromising token integrity and authentication.

An attacker can forge JWT tokens that are accepted as valid by vulnerable ruby-jwt versions, leading to unauthorized access and potential privilege escalation. The vulnerability impacts confidentiality and integrity of authentication mechanisms relying on these tokens. The CVSS score of 9.1 reflects a critical severity with network attack vector, no privileges required, and no user interaction needed.

A fix is available in ruby-jwt versions 2.10.3 and 3.2.0. Users should upgrade to these versions or later to remediate this vulnerability. Since this is a library, ensure all dependent applications update their ruby-jwt dependency accordingly. The vendor manages remediation for the cloud-hosted service if applicable; check vendor advisories for confirmation.