All vulnerabilities
CVE-2026-89313GHSA-v7r8-g6h9-99vv

Eclipse KeyPont - GOSE: JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

Eclipse Foundation Eclipse KeyPont - GOSE
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.0-rc4Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of "not found".

Text from CVE List

Affected versions 4

  • Eclipse KeyPont - GOSEaffected: 0.7.5 through 0.13.0-rc1CVE List
  • Eclipse KeyPont - GOSEaffected: all versions before 1.0.0-rc4CVE List
  • github.com/ThalesGroup/gose, go>= 0.7.5, <= 0.13.0-rc1GitHub
  • github.com/eclipse-keypont/gose, go< 1.0.0-rc4GitHub

References 1