CyberSecBulletin

Jwt vulnerabilities

We track 2 vulnerabilities in Jwt products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 14, 2026.

2vulnerabilities
2critical
0high
0exploited
9.1average CVSS score

Latest Jwt vulnerabilities

  • 9.1 Critical severity

    ruby-jwt: Improper Authentication

    CVE-2026-45363Jwt

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid dig

  • 9.1 Critical severity

    ruby-jwe: Improper Validation of Integrity Check Value

    CVE-2025-54887Jwt

    jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitr