CVE-2026-89313 Details
Description
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
A vulnerability exists in the JwksTrustStore.Get method of the Eclipse KeyPont library, specifically in versions 0.7.5 through 0.13.0-rc1. When a requested key ID (kid) is not found, the method incorrectly returns the last key from the JWKS document with a nil error, instead of returning nil to indicate the key was not found. This issue arises because the method assigns each parsed key to a named return value while refreshing the JWKS cache, and the final return statement, lacking an explicit value, sends the last parsed key as a default return value.
Users should upgrade to version 1.0.0-rc4 or later. Those still using 'github.com/ThalesGroup/gose' must change the module path to 'github.com/eclipse-keypont/gose' and upgrade to version 1.0.0-rc4 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse KeyPont gose | < 1.0.0-rc4 (semver) |
CPE
Remediation
| |
| ThalesGroup gose | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |