CVE-2026-89313: CWE-706 Use of Incorrectly-Resolved Name or Reference in Eclipse Foundation Eclipse KeyPont - GOSE
Description
CVE-2026-89313 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function JwksTrustStore.Get incorrectly returns the last key in the JWKS document when a requested key ID (kid) is not found, instead of signaling a 'not found' error. This occurs due to the use of a named return value and a naked return statement that returns the last parsed key with a nil error. This behavior can cause callers to receive incorrect key data, potentially leading to trust or validation issues.
CVSS v4.0
Score 6.3medium
Affected software
Eclipse Foundation
Eclipse KeyPont - GOSE
Eclipse Foundation
Eclipse KeyPont - GOSE
pkg:github/github.com/ThalesGroup/gosepkg:github/github.com/eclipse-keypont/goseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the JwksTrustStore.Get function assigning each parsed key to its named return value while refreshing the JWKS cache. If the requested key ID (kid) is missing, the function's trailing naked return statement returns the last key in the JWKS document along with a nil error, providing an incorrect key instead of indicating the key was not found. This is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference).
Potential Impact
The flaw causes the function to return an incorrect key without an error when a requested key ID is absent. This can lead to incorrect trust decisions or validation failures in systems relying on the JWKS cache, potentially undermining security mechanisms that depend on accurate key retrieval.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Eclipse Foundation advisories for updates and consider implementing additional validation checks to detect incorrect key returns until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-11T13:55:44.985Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb1ecf4d27ba8daaeb7e1d
Added to database: 10/23/2026, 08:46:07 UTC
Last enriched: 10/23/2026, 09:00:42 UTC
Last updated: 10/23/2026, 09:01:15 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.