Eclipse KeyPont versions 2.0.0-rc3 through 2.0.0-rc8 contain a vulnerability in ML-KEM key-pair lookup functions where the public key is not verified against the private key. This allows an attacker with unauthenticated token access to substitute a public key and receive shared secrets intended for the legitimate private key owner, compromising confidentiality. The issue does not affect v1 module paths which lack ML-KEM support.