{"id":"CVE-2026-89313","published":"2026-10-23T09:17:07.797","lastModified":"2026-10-23T19:30:07.567","description":"`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of \"not found\".","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-706"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv","tags":[]}],"hasPoc":true,"ai":null}