JWT.decode is called with verification enabled (true) but no algorithm: / algorithms: option, so the library trusts whatever alg the token header names.

Why this matters

An attacker can switch the algorithm, e.g. present an HS256 token signed with your RSA public key as if it were the HMAC secret, and the signature check passes (algorithm-confusion, CWE-347).

Always pin the accepted algorithm(s): JWT.decode(token, key, true, { algorithm: 'HS256' }) JWT.decode(token, public_key, true, { algorithms: ['RS256'] }) ruby-jwt's own docs mark this allow-list as mandatory for safe decoding.

require 'jwt'

def verify(token)
  key = ENV.fetch('JWT_SECRET')
  # ruleid: auth.ruby.jwt.missing-algorithm-allowlist
  payload, = JWT.decode(token, key, true)
  payload
end

def verify_rsa(token, public_key)
  # ruleid: auth.ruby.jwt.missing-algorithm-allowlist
  JWT.decode(token, public_key, true)
end

require 'jwt'

def verify(token)
  key = ENV.fetch('JWT_SECRET')
  # ok: algorithm allow-list pinned via the options hash
  payload, = JWT.decode(token, key, true, { algorithm: 'HS256' })
  payload
end

def verify_rsa(token, public_key)
  # ok: asymmetric allow-list pinned
  JWT.decode(token, public_key, true, algorithms: ['RS256'])
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.jwt.missing-algorithm-allowlist -- <reason>

References