CVE-2026-45363: ruby-jwt Auth Bypass Vulnerability

CVE-2026-45363 Overview

CVE-2026-45363 is an authentication bypass vulnerability [CWE-287] in the ruby-jwt library, a Ruby implementation of the RFC 7519 JSON Web Token (JWT) standard. Versions prior to 2.10.3 and 3.2.0 accept attacker-forged tokens when HMAC verification is performed with an empty key. The flaw affects HS256, HS384, and HS512 verification paths reached through JWT.decode and JWT::EncodedToken#verify_signature!. Applications passing empty strings, nil, or keyfinder blocks that return empty values are vulnerable. Remote attackers can forge tokens and impersonate any user without prior authentication.

Critical Impact
Unauthenticated remote attackers can forge valid JWTs to bypass authentication on any Ruby application using vulnerable ruby-jwt versions with HMAC verification and empty-key conditions.

Affected Products

ruby-jwt versions prior to 2.10.3
ruby-jwt 3.x versions prior to 3.2.0
Ruby applications using JWT.decode or JWT::EncodedToken#verify_signature! with HS256/HS384/HS512

Discovery Timeline

2026-07-14 - CVE-2026-45363 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45363

Vulnerability Analysis

The vulnerability resides in how ruby-jwt handles HMAC signature verification when the secret key is empty. When an application calls JWT.decode(token, '', true, algorithm: 'HS256'), the library invokes OpenSSL::HMAC.digest('SHA256', '', payload). OpenSSL accepts the empty string as a valid HMAC key and returns a deterministic digest. Because ruby-jwt lacks a precondition check rejecting empty keys, an attacker who knows the algorithm and payload can compute a valid signature and forge tokens.

The same vulnerable code path is reached under several additional conditions. A keyfinder block or key_finder: argument that returns an empty string, nil, or an array containing nil for an unknown key identifier will trigger the flaw. This commonly occurs when key lookup logic silently fails for unrecognized kid header values, returning nothing instead of raising an error.

Root Cause

The root cause is missing input validation on the HMAC key material before invoking the underlying cryptographic primitive. RFC 2104 does not prohibit empty HMAC keys, but ruby-jwt should enforce an application-level precondition. The library trusts caller-supplied and dynamically resolved keys without verifying they contain sufficient entropy, allowing empty or nil values to reach the verification routine.

Attack Vector

An attacker crafts a JWT with a chosen header and payload, then computes the HMAC signature using an empty key. When the vulnerable application decodes this token under any of the trigger conditions, verification succeeds and the forged claims are treated as authentic. This enables account takeover, privilege escalation, and access to protected API endpoints. Full technical details are available in the GitHub Security Advisory GHSA-c32j-vqhx-rx3x.

Detection Methods for CVE-2026-45363

Indicators of Compromise

Successful authentication events using JWTs whose signature validates against an empty HMAC key
Unexpected kid header values in inbound JWTs that trigger fallback key resolution paths
Authentication log anomalies showing valid sessions for users without corresponding login flows

Detection Strategies

Audit application code for calls to JWT.decode where the key parameter can be an empty string, nil, or resolved dynamically
Review keyfinder blocks and key_finder: arguments for code paths that return empty or nil values on unknown keys
Inspect dependency manifests (Gemfile.lock) for ruby-jwt versions below 2.10.3 or 3.2.0

Monitoring Recommendations

Log all JWT verification failures and successes with the resolved key identifier for forensic review
Alert on authentication events where the HMAC key used for verification is empty or missing
Monitor for spikes in requests carrying unusual kid values or unknown token issuers

How to Mitigate CVE-2026-45363

Immediate Actions Required

Upgrade ruby-jwt to version 2.10.3 (2.x branch) or 3.2.0 (3.x branch) immediately
Audit all JWT.decode call sites to ensure secrets are non-empty and validated before use
Rotate any HMAC secrets that may have been exposed or defaulted to empty values during the vulnerable window

Patch Information

The maintainers released fixes in ruby-jwt v2.10.3 and ruby-jwt v3.2.0. The patches add explicit precondition checks that reject empty, nil, or otherwise invalid key material before invoking OpenSSL::HMAC.digest. Review the remediation commit and the follow-up commit for implementation details.

Workarounds

Wrap JWT.decode calls with application-level guards that raise when the resolved key is empty, nil, or blank
Ensure keyfinder implementations raise an exception for unknown key identifiers rather than returning nil or an empty string
Enforce a minimum key length policy (recommended 256 bits for HS256) at configuration load time to prevent misconfiguration

bash

# Update the gem to a patched release
bundle update jwt --conservative

# Verify the installed version is >= 2.10.3 or >= 3.2.0
bundle show jwt