{"id":"CVE-2026-89315","published":"2026-10-23T09:17:08.027","lastModified":"2026-10-23T19:30:07.567","description":"`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `\"A\" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-248"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-hwm6-rwv6-xgq8","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-hwm6-rwv6-xgq8","tags":[]}],"hasPoc":true,"ai":null}