CVE-2026-89313

The JwksTrustStore.Get function in the gose library is vulnerable to a logic error where it returns the last fetched JWKS key with a nil error when a requested kid is absent. This occurs because the function assigns parsed keys to a named return value during cache refreshes, and a trailing naked ...