jwt ruby-jwe vulnerabilities

Latest jwt ruby-jwe CVEs

Newest publication first

1. CVE-2025-54887 jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

   Published 2025-08-08

   Critical·CVSS 9.1

   jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.