🛡️ CVE-2026-45363 — jwt

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token.

OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key, and no `raise

InvalidKeyError if key.empty?` precondition exists in the HMAC algorithm.

```

JWT.decode(token, "", true, algorithm: 'HS256')

-> JWA::Hmac.verify(verification_key: "", ...)

-> OpenSSL::HMAC.digest('SHA256', "", signing_input) == signature

```

The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an

array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty

arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing.

```

JWT.decode(token, nil, true, algorithms: ['HS256']) { |_h| "" }

-> find_key returns "" # "" && !Array("").empty? == true

-> JWA::Hmac.verify(verification_key: "", ...)

-> verifies

```

Common application patterns that produce the unsafe value: redis.get("kid:#{kid}").to_s, ORM string columns with default: '', ENV['SECRET'] || '', Hash.new('') lookups, [primary, fallback] where fallback may be nil. Applications passing a non-empty static key:, or whose keyfinder returns nil / raises on miss, are not affected.

The existing enforce_hmac_key_length option would block this but defaults to false. On OpenSSL ≥ 3.5 the empty-key HMAC.digest call no longer raises, so the OpenSSL-3.0 rescue in JWA::Hmac#sign does not fire.

Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and

JWT::EncodedToken#verify_signature!(key_finder:)