ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

🗓️ 18 May 2026 17:24:55Reported by GitHub Advisory DatabaseType

Empty-key HMAC bypass in ruby-jwt lets forged tokens verify with an empty key for HS256/384/512.

Reporter	Title	Published	Views	Family All 129
attackerkb	CVE-2026-44351	13 May 202619:12	–	attackerkb
attackerkb	CVE-2026-45363	14 Jul 202621:32	–	attackerkb
BDU FSTEC	JWT Ruby Authentication DoS	7 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-45363 vulnerabilities	26 May 202601:18	–	cgr
Circl	CVE-2026-44351	29 Apr 202611:07	–	circl
Circl	CVE-2026-45363	14 Jul 202622:16	–	circl
CNNVD	Fast-JWT authorization issue vulnerability	13 May 202600:00	–	cnnvd
CVE	CVE-2026-44351	13 May 202619:12	–	cve
CVE	CVE-2026-45363	14 Jul 202621:32	–	cve
Cvelist	CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass	13 May 202619:12	–	cvelist

Vulners

Node

jwt_project jwtRange<2.10.3rubygems

jwt_project jwtRange3.0.0–3.2.0rubygems

Source	Link
github	www.github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x
github	www.github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
github	www.github.com/jwt/ruby-jwt/releases/tag/v3.2.0
github	www.github.com/jwt/ruby-jwt/issues/724
github	www.github.com/jwt/ruby-jwt/releases/tag/v2.10.3
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/jwt/CVE-2026-45363.yml
cve	www.cve.org/CVERecord
github	www.github.com/advisories/GHSA-c32j-vqhx-rx3x

02 Jun 2026 22:12Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.1

EPSS0.00364

SSVC