JWE is missing AES-GCM authentication tag validation in encrypted JWE
Published: August 07, 2025
SECURITY IDENTIFIERS
- CVE: CVE-2025-54887 (NVD)
- GHSA: GHSA-c7p4-hx26-pr73
- Vendor Advisory: https://github.com/jwt/ruby-jwe/security/advisories/GHSA-c7p4-hx26-pr73
GEM
SEVERITY
CVSS v3.x: 9.1 (Critical)
PATCHED VERSIONS
>= 1.1.1
DESCRIPTION
Overview
The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs.
Impact
- JWEs can be modified to decrypt to an arbitrary value
- JWEs can be decrypted by observing parsing differences
- The GCM internal GHASH key can be recovered
Am I Affected?
You are affected by this vulnerability even if you do not
use an AES-GCM encryption algorithm for your JWEs.
Patches
The version 1.1.1 fixes the issue by adding the tag length check for the AES-GCM algorithm.
Important: As the GHASH key could have leaked, you must rotate the encryption keys after upgrading to version 1.1.1.