ruby-jwt vulnerabilities

1 known vulnerability in ruby-jwt from Jwt. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  ruby-jwt: Improper Authentication

  CVE-2026-45363Jul 14, 2026Jwt

  ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid dig