ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and     3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because     OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key     precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder:
    argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256,     HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is     fixed in versions 2.10.3 and 3.2.0. (CVE-2026-45363)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and
    3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because
    OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key
    precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder:
    argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256,
    HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is
    fixed in versions 2.10.3 and 3.2.0. (CVE-2026-45363)

ID	Name	Product	Family	Type	Severity
327193	Linux Distros Unpatched Vulnerability : CVE-2026-45363	Nessus	Misc.	Local	critical
442036	SCA: security update for jwt (GHSA-c32j-vqhx-rx3x)	Tenable Cloud Security	SCA Checks	Local	critical
442036	SCA: security update for jwt (GHSA-c32j-vqhx-rx3x)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-45363

critical

Tenable Plugins

critical

critical

critical