Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-89313

JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0.7.5 to ≤ 0.13.0-rc1affected

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0 to < 1.0.0-rc4affected

References