CVE-2026-89313EUVD-2026-108633GHSA-V7R8-G6H9-99VV
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.0-rc4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The JwksTrustStore component, which looks up signing keys by key ID from a JSON Web Key Set, can return an unrelated key with no error when the requested key is missing. Applications that rely on it may then make incorrect trust decisions, such as verifying tokens against the wrong key.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Timeline
- CVE published
- First seen by cve.now
Affected versions
- github.com/ThalesGroup/gose
From 0.7.5 · through 0.13.0-rc1
- github.com/eclipse-keypont/gose
fixed in 1.0.0-rc4