Critical JWE Ruby Flaw (CVE-2025-54887) Bypasses AES-GCM Authentication, Exposing Encrypted Data
Ddos 
A severe security vulnerability has been uncovered in the Ruby implementation of JSON Web Encryption (JWE), tracked as CVE-2025-54887, carrying a CVSS score of 9.1. The flaw stems from missing authentication tag validation in the AES-GCM encryption process, leaving encrypted data open to brute-force manipulation and unauthorized decryption.
The JWE standard, defined in RFC 7516, is widely used to secure sensitive data through encryption. However, the affected Ruby package — which has seen over 7.2 million downloads — fails to properly verify the AES-GCM authentication tag. This oversight enables attackers to:
- Modify JWEs to decrypt to arbitrary values.
- Decrypt encrypted JWEs by exploiting differences in parsing behavior.
- Recover the GCM internal GHASH key, a critical component for data authentication.
Alarmingly, the vulnerability impacts all deployments using the package, even if AES-GCM is not the chosen encryption algorithm for the JWE in question.
AES-GCM is designed not only to encrypt data but also to ensure its integrity. By skipping authentication tag validation, the encryption loses one of its most important safeguards. Without it, attackers can craft malicious JWEs or recover sensitive information, potentially compromising entire systems.
As the security advisory warns:
“The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs.”
The vulnerability is addressed in version 1.1.1 of the JWE Ruby package, which adds authentication tag length checks for AES-GCM. However, patching alone is not enough. Security teams are urged to rotate all encryption keys immediately after upgrading, as the GHASH key may already be compromised.
Related Posts:
- Chihuahua Stealer Unleashed: Obfuscated PowerShell and AES-GCM Encryption Fuel This Advanced Data Theft Campaign
- CVE-2024-45409 (CVSS 10): Critical Ruby-SAML Flaw Leaves User Accounts Exposed
- Ruby on Rails Remote Code Execution Vulnerability
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
