CVE-2026-89313

The JwksTrustStore.Get function in the gose library is vulnerable to a logic error where it returns the last fetched JWKS key with a nil error when a requested kid is absent. This occurs because the function assigns parsed keys to a named return value during cache refreshes, and a trailing naked ...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the JWKS key caching process. An attacker can gain unauthorized access to another issuer or tenant's resources by crafting a valid token for one allowed issuer and exploiting the cache...