The vulnerability exists because the Ruby jwt library permits an empty secret key during verification of HS256, HS384, or HS512 tokens. OpenSSL::HMAC.digest('SHA256', '', payload) produces a valid digest even when the key is empty, and the library does not enforce a non‑empty key precondition. Therefore, JWT.decode(token, '', true, algorithm: 'HS256') accepts a forged token signed with an empty key. The same flaw is triggered when a key_finder block or the key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, which also allows forged tokens to be validated. An attacker can create counterfeit JWTs that are accepted by vulnerable applications, enabling identity spoofing or privilege escalation without knowledge of the real signing key.

ruby-jwt, the Ruby implementation of JWT, is affected in all releases prior to 2.10.3 and 3.2.0. Any application using the gem’s JWT.decode or JWT::EncodedToken#verify_signature! with HS256, HS384, or HS512 algorithms and supplying an empty string, nil, or a finder block that returns such values is vulnerable.

The CVSS score of 9.1 classifies this as critical. The EPSS score of less than 1% indicates a low likelihood of exploitation in the general population; nonetheless, the vulnerability is not in the CISA KEV catalog. The likely attack vector is remote: an attacker crafts a token with any payload, signs it with an empty key or lets a key_finder return such a value, and submits it to a vulnerable service that accepts the token for authentication. If the service trusts the token without validating the key, the attacker can gain unauthorized access with minimal effort.