CVE-2026-89313

MediumCVSS 6.3

Published: 23/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of "not found".

Risk Assessment

The service may accept an incorrect key instead of rejecting an unknown key identifier, potentially leading to improper verification of signatures or tokens. This may weaken authentication and trust mechanisms.

Recommendation

Update the library to a patched version that returns an error when the key is missing. Verify the handling of unknown kid values in applications using this library.

Other vulnerabilities in JWK/JWKS library

CVE-2026-89314Medium
jwkFields.CheckConsistency detected duplicate key_ops entries using a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.

Original NVD description (English source)

`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".

Vulnerability data from NVD (NIST) · CISA KEV · EPSS