Common Weakness Enumeration
CWE-1391
Allowed-with-ReviewUse of Weak Credentials
Abstraction: Class · Status: Incomplete
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
105 vulnerabilities reference this CWE, most recent first.
GHSA-624F-P4GG-QWG2
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-05-28 12:30
VLAI
Details
Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.
This issue was fixed in version 1.00B16CP.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-4377"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:39Z",
"severity": "MODERATE"
},
"details": "Dlink\u00a0DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.\n\nThis issue was fixed in version\u00a01.00B16CP.",
"id": "GHSA-624f-p4gg-qwg2",
"modified": "2026-05-28T12:30:34Z",
"published": "2026-05-28T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4377"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/05/CVE-2026-4377"
},
{
"type": "WEB",
"url": "https://www.dlink.com/pl/pl/products/dwr-1820-cp#support"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-65FR-GPW6-J777
Vulnerability from github – Published: 2023-05-22 21:30 – Updated: 2024-04-04 04:16
VLAI
Details
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.
Severity
8.3 (High)
{
"affected": [],
"aliases": [
"CVE-2023-31240"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-22T20:15:10Z",
"severity": "CRITICAL"
},
"details": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nSnap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",
"id": "GHSA-65fr-gpw6-j777",
"modified": "2024-04-04T04:16:46Z",
"published": "2023-05-22T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31240"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"type": "WEB",
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7CX5-PCXX-59Q4
Vulnerability from github – Published: 2024-10-15 12:30 – Updated: 2024-10-15 12:30
VLAI
Details
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-45272"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T11:15:11Z",
"severity": "HIGH"
},
"details": "An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.",
"id": "GHSA-7cx5-pcxx-59q4",
"modified": "2024-10-15T12:30:37Z",
"published": "2024-10-15T12:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45272"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-068"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7RXX-X775-HWQ2
Vulnerability from github – Published: 2025-08-02 03:31 – Updated: 2025-11-03 21:34
VLAI
Details
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-6077"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-02T03:15:24Z",
"severity": "CRITICAL"
},
"details": "Partner Software\u0027s Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.",
"id": "GHSA-7rxx-x775-hwq2",
"modified": "2025-11-03T21:34:17Z",
"published": "2025-08-02T03:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6077"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/317469"
},
{
"type": "WEB",
"url": "https://partnersoftware.com/resources/software-release-info-4-32"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/317469"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7WPM-58FR-6P69
Vulnerability from github – Published: 2025-02-06 21:32 – Updated: 2025-02-12 00:32
VLAI
Details
An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information via the Weak default WiFi password generation algorithm in WiFi routers.
Severity
8.0 (High)
{
"affected": [],
"aliases": [
"CVE-2025-22936"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T20:15:40Z",
"severity": "HIGH"
},
"details": "An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information via the Weak default WiFi password generation algorithm in WiFi routers.",
"id": "GHSA-7wpm-58fr-6p69",
"modified": "2025-02-12T00:32:15Z",
"published": "2025-02-06T21:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22936"
},
{
"type": "WEB",
"url": "https://sec.stanev.org/advisories/Smartcom_default_WPA_password.txt"
},
{
"type": "WEB",
"url": "http://smartcom.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-829W-C4JV-VQJ4
Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-10 09:31
VLAI
Details
DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-66409"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T09:17:23Z",
"severity": "MODERATE"
},
"details": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\nThe password may be analyzed and obtained to connect to the access point of an affected robot.",
"id": "GHSA-829w-c4jv-vqj4",
"modified": "2026-08-10T09:31:24Z",
"published": "2026-08-10T09:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66409"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU92804348"
},
{
"type": "WEB",
"url": "https://robot.hellohas.co.jp/news/update_20260331"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8JM2-4R4F-748V
Vulnerability from github – Published: 2024-03-25 06:30 – Updated: 2025-03-28 09:30
VLAI
Details
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-29071"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-25T04:15:09Z",
"severity": "HIGH"
},
"details": "HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.",
"id": "GHSA-8jm2-4r4f-748v",
"modified": "2025-03-28T09:30:30Z",
"published": "2024-03-25T06:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29071"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93546510"
},
{
"type": "WEB",
"url": "https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f"
},
{
"type": "WEB",
"url": "https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9V64-447R-WCH6
Vulnerability from github – Published: 2022-05-13 01:12 – Updated: 2024-01-24 21:21
VLAI
Summary
Moodle Temporary Passwords are Brute Force-able
Details
The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.7.2"
},
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.6.5"
},
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.8"
},
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-7845"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-15T22:32:55Z",
"nvd_published_at": "2014-11-24T11:59:00Z",
"severity": "HIGH"
},
"details": "The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack.",
"id": "GHSA-9v64-447r-wch6",
"modified": "2024-01-24T21:21:56Z",
"published": "2022-05-13T01:12:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7845"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/04f2e83ce76cf931e6614497c1a7cc6c8afb9454"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/3128901f99d41d9368e81ffc67f4bc0535221e02"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/40a04658232d898223462f84d8cd35510338acbe"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/ece03f3b13c5eefa7bb008401b9414eed620eebc"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=275152"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150914064838/http://www.securitytracker.com/id/1031215"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47050"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/11/17/11"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Moodle Temporary Passwords are Brute Force-able"
}
GHSA-9X7X-HW35-PFRH
Vulnerability from github – Published: 2026-05-08 12:31 – Updated: 2026-05-08 15:31
VLAI
Details
Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-8076"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T12:16:29Z",
"severity": "CRITICAL"
},
"details": "Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system.",
"id": "GHSA-9x7x-hw35-pfrh",
"modified": "2026-05-08T15:31:20Z",
"published": "2026-05-08T12:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8076"
},
{
"type": "WEB",
"url": "https://labs.itresit.es/2026/05/07/cashdro-vulnerabilities-from-pentest-to-stealing-money"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C32J-VQHX-RX3X
Vulnerability from github – Published: 2026-05-18 17:24 – Updated: 2026-06-02 22:12
VLAI
Summary
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
Details
JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token.
OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key, and no raise
InvalidKeyError if key.empty? precondition exists in the HMAC algorithm.
JWT.decode(token, "", true, algorithm: 'HS256')
-> JWA::Hmac.verify(verification_key: "", ...)
-> OpenSSL::HMAC.digest('SHA256', "", signing_input) == signature
The same path is reached when a keyfinder block or key_finder: argument returns "", nil, or an array containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty arrays, and JWT::JWA::Hmac silently coerces nil to "" (signing_key ||= '') before signing.
JWT.decode(token, nil, true, algorithms: ['HS256']) { |_h| "" }
-> find_key returns "" # "" && !Array("").empty? == true
-> JWA::Hmac.verify(verification_key: "", ...)
-> verifies
Common application patterns that produce the unsafe value: redis.get("kid:#{kid}").to_s, ORM string columns with default: '', ENV['SECRET'] || '', Hash.new('') lookups, [primary, fallback] where fallback may be nil. Applications passing a non-empty static key:, or whose keyfinder returns nil / raises on miss, are not affected.
The existing enforce_hmac_key_length option would block this but defaults to false. On OpenSSL ≥ 3.5 the empty-key HMAC.digest call no longer raises, so the OpenSSL-3.0 rescue in JWA::Hmac#sign does not fire.
Affects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and
JWT::EncodedToken#verify_signature!(key_finder:)
Severity
7.4 (High)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "jwt"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "jwt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45363"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-287",
"CWE-326"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-18T17:24:55Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "`JWT.decode(token, \u0027\u0027, true, algorithm: \u0027HS256\u0027)` accepts an attacker-forged token.\n`OpenSSL::HMAC.digest(\u0027SHA256\u0027, \u0027\u0027, payload)` returns a valid digest under an empty key, and no `raise\n InvalidKeyError if key.empty?` precondition exists in the HMAC algorithm.\n\n```\nJWT.decode(token, \"\", true, algorithm: \u0027HS256\u0027)\n -\u003e JWA::Hmac.verify(verification_key: \"\", ...)\n -\u003e OpenSSL::HMAC.digest(\u0027SHA256\u0027, \"\", signing_input) == signature\n```\n\nThe same path is reached when a keyfinder block or key_finder: argument returns \"\", nil, or an\narray containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty\narrays, and JWT::JWA::Hmac silently coerces nil to \"\" (signing_key ||= \u0027\u0027) before signing.\n\n```\nJWT.decode(token, nil, true, algorithms: [\u0027HS256\u0027]) { |_h| \"\" }\n -\u003e find_key returns \"\" # \"\" \u0026\u0026 !Array(\"\").empty? == true\n -\u003e JWA::Hmac.verify(verification_key: \"\", ...)\n -\u003e verifies\n```\nCommon application patterns that produce the unsafe value: `redis.get(\"kid:#{kid}\").to_s`, ORM string columns with `default: \u0027\u0027`, `ENV[\u0027SECRET\u0027] || \u0027\u0027, Hash.new(\u0027\u0027)` lookups, [primary, fallback] where fallback may be nil. Applications passing a non-empty static key:, or whose keyfinder returns nil / raises on miss, are not affected.\n\nThe existing `enforce_hmac_key_length` option would block this but defaults to false. On OpenSSL \u2265 3.5 the empty-key HMAC.digest call no longer raises, so the OpenSSL-3.0 rescue in JWA::Hmac#sign does not fire.\n\nAffects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and\n`JWT::EncodedToken#verify_signature!(key_finder:)`",
"id": "GHSA-c32j-vqhx-rx3x",
"modified": "2026-06-02T22:12:50Z",
"published": "2026-05-18T17:24:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x"
},
{
"type": "WEB",
"url": "https://github.com/jwt/ruby-jwt/issues/724"
},
{
"type": "WEB",
"url": "https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f"
},
{
"type": "PACKAGE",
"url": "https://github.com/jwt/ruby-jwt"
},
{
"type": "WEB",
"url": "https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3"
},
{
"type": "WEB",
"url": "https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jwt/CVE-2026-45363.yml"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45363"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351"
}
Mitigation
Architecture and Design
Operation
When the user changes or sets a password, check the password against a database of already compromised or breached passwords. These passwords are likely to be used in password guessing attacks.
No CAPEC attack patterns related to this CWE.