Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
5/8 CVE-2026-45363 in ruby-jwt is a reminder: auth libraries need urgency too. If a Ruby app accepts external JWTs, update the dependency actually in use—not only the OS package. bundle list | grep -i jwt Then test forged and expired tokens are rejected.
⚠️ Linux Red Hat Hardened Images alert: CVE-2026-45363 (CVSS 7.4) Remote attackers could bypass authentication. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-45363 #Linux #RedHatHardenedImages #CyberSecurity #CVE
Post summary
CVE‑2026‑45363 allows authentication bypass on Red Hat Hardened Images; the issue is addressed in a vendor‑listed patch release, so upgrading is recommended.