Cyber ·
USN-9059-1: incorrect HMAC signature verification in ruby-jwt
Security notice from the Ubuntu Security feed, dated November 11, 2026, about the ruby-jwt library. When the verification key is empty or missing, HMAC signatures are checked incorrectly, which may allow token forgery and authentication bypass.
Fact: notice USN-9059-1, published November 11, 2026 on the Ubuntu Security feed, describes a flaw in the ruby-jwt library. The library incorrectly verifies HMAC signatures when the verification key is empty or missing. According to the text, a remote attacker could possibly use the issue to forge tokens and bypass authentication. The available text does not list affected versions, fixed versions or signs of exploitation; those details are in the original notice. Relevance: anyone using ruby-jwt in authentication systems should check whether the installed version is affected and apply the update the vendor indicates. How to verify: search for identifier USN-9059-1 on the official Ubuntu Security site, check the affected versions and fixed packages, and compare them with your project's dependency inventory.