CVE-2025-54887 json
jwe: Missing AES-GCM authentication tag validation in encrypted JWEs
published 2025-08-07 15 mo ago modified 2026-06-17 4 mo ago also GHSA-c7p4-hx26-pr73 , EUVD-2025-23966
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 15 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | jwe | <1.1.1 |
1.1.1 |
Affected products
- jwt ruby-jwe
Classification
- Weakness
-
- CWE-354 Improper Validation of Integrity Check Value
References
-
github.com
/jwt/ruby-jwe/commit/1e719d79ba3d7aadaa39a2f08c25df077a0f9ff1
web
-
github.com
/jwt/ruby-jwe/security/advisories/GHSA-c7p4-hx26-pr73
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-54887
advisory
-
github.com
/jwt/ruby-jwe
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/jwe/CVE-2025-54887.yml
web
Sources
- CVE List CVE-2025-54887
- GitHub Advisory GHSA-c7p4-hx26-pr73
- NVD CVE-2025-54887
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.