The json-jwt (aka JSON::JWT) gem 1.16.x before 1.16.6, 1.15.x before 1.15.3.1 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-51774
• https://github.com/P3ngu1nW/CVE_Request/blob/main/novjson-jwt.md
• nov/json-jwt#120
• nov/json-jwt@9c4d842
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json-jwt/CVE-2023-51774.yml
• nov/json-jwt#121
• nov/json-jwt@593ea8b