CVE-2026-89315 JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

CVE-2026-89315

The JwtClaims.MarshalJSON function is vulnerable to a panic due to the use of reflect.StructOf at runtime. The application synthesizes field names by prepending "A" to untyped claim names; if these resulting names are not valid Go identifiers or result in duplicate fields, the program will crash....

CVE-2026-19363

CVE-2026-19363 affects the lmammino oidc-authorizer package up to version 0.4.0. The flaw resides in the unwrap function of src/handler.rs in the Fixed Message Handler, where manipulating the jwtClaims argument enables deserialization and remote execution. Public exploitation is noted, and the ve...