ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

🗓️ 18 May 2026 17:24:55Reported by GitHub Advisory DatabaseType

Empty-key HMAC bypass in ruby-jwt lets forged tokens verify with an empty key for HS256/384/512.

Reporter	Title	Published	Views	Family All 24
ATTACKERKB	CVE-2026-44351	13 May 202619:12	–	attackerkb
Chainguard	CVE-2026-45363 vulnerabilities	26 May 202601:18	–	cgr
Circl	CVE-2026-44351	29 Apr 202611:07	–	circl
CNNVD	fast-jwt 授权问题漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-44351	13 May 202619:12	–	cve
CVE	CVE-2026-45363	18 May 202617:24	–	cve
Cvelist	CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass	13 May 202619:12	–	cvelist
Github Security Blog	fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver	6 May 202622:26	–	github
NVD	CVE-2026-44351	13 May 202620:16	–	nvd
OSV	CGA-P4XH-WV5C-VCQ6	26 May 202600:12	–	osv

Vulners

Node

jwt_project jwtRange<2.10.3rubygems

jwt_project jwtRange3.0.0–3.2.0rubygems

Source	Link
github	www.github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x
github	www.github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
github	www.github.com/jwt/ruby-jwt/releases/tag/v3.2.0
github	www.github.com/jwt/ruby-jwt/issues/724
github	www.github.com/jwt/ruby-jwt/releases/tag/v2.10.3
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/jwt/CVE-2026-45363.yml
cve	www.cve.org/CVERecord
github	www.github.com/advisories/GHSA-c32j-vqhx-rx3x

02 Jun 2026 22:12Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.1

EPSS0.00015

SSVC