# CVE-2026-89313: eclipse-keypont gose JwksTrustStore.Get returns wrong key on absent kid

Source: https://junglewise.ai/threats/cve-2026-89313-jwkstruststore-get-assigned-each-parsed-key-to-the-function-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-89313 · Severity: info · Published 2026-10-23

eclipse-keypont's gose library parses JSON Web Key Sets (JWKS) to validate cryptographic tokens in security workflows. A bug causes the library to return the last key in the set when a requested key ID is absent, instead of reporting "not found"—enabling token verification with the wrong key during key rotation scenarios.

Technologies: [Eclipse KeyPont Gose](https://junglewise.ai/threats/technologies/eclipse-keypont-gose). Vendors: [Eclipse KeyPont](https://junglewise.ai/threats/vendors/eclipse-keypont).

## Quick answers

**Is CVE-2026-89313 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89313 being exploited in the wild.

**How severe is CVE-2026-89313?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Eclipse KeyPont Gose 0.7.5 through 1.0.0-rc3 (ThalesGroup/gose: 0.7.5 through 0.13.0-rc1).

**Is there a fix for CVE-2026-89313?** Yes: fixed in eclipse-keypont gose 1.0.0-rc4 and later. Until then: Callers using TrustStore.Get directly should verify that the returned key's Kid() matches the one requested before use, treating a mismatch as "not found". Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89313 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89313?** Check whether you run Eclipse KeyPont Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in eclipse-keypont gose 1.0.0-rc4 and later

Callers using TrustStore.Get directly should verify that the returned key's Kid() matches the one requested before use, treating a mismatch as "not found".

## Technical details

A Go library function `JwksTrustStore.Get` uses a named return value that inadvertently retains the last parsed key from a loop. When the requested kid is not found in the refreshed cache, a naked return statement returns this stale key with a nil error instead of nil. The bug affects applications directly calling the exported Get method or using the TrustStore interface; cryptographic signature verification still occurs, but against an unintended key—breaking key rotation semantics and enabling key confusion.

## Affected products

- eclipse-keypont gose 0.7.5 through 1.0.0-rc3 (ThalesGroup/gose: 0.7.5 through 0.13.0-rc1)

## Timeline

- 2026-09-01: disclosed
- 2026-10-23: advisory

## References

- [https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv](https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv)

## Related threats

- [Thales gose JweDirectDecryptorBlock unchecked length header](https://junglewise.ai/threats/cve-2026-89319-jwedirectdecryptorblock-decrypt-read-a-64-bit-plaintext-length)
- [gose JweRsaKeyEncryptionDecryptorImpl panic on invalid IV length](https://junglewise.ai/threats/cve-2026-89318-jwersakeyencryptiondecryptorimpl-decrypt-passed-the-jwe-s)
- [gose JWS critical header bypass in JWT verification](https://junglewise.ai/threats/cve-2026-89317-gose-parsed-the-jws-crit-header-into-jwsheader-crit-and-then)
- [gose JwtClaims.MarshalJSON panic in reflect.StructOf](https://junglewise.ai/threats/cve-2026-89315-jwtclaims-marshaljson-built-a-go-struct-at-runtime-with-reflect)
- [Eclipse KeyPont gose quadratic time key_ops validation DoS](https://junglewise.ai/threats/cve-2026-89314-jwkfields-checkconsistency-detected-duplicate-key-ops-entries)