Live › vulnerability › CVE-2026-89313
Go to dashboardWhen a requested key ID is absent from a JWKS document, JwksTrustStore.Get returns the last key in the document with a nil error instead of reporting not found. A caller that trusts that key can accept tokens verified against the wrong key.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of "not found".
This page as .md · .json · in your agent: get_signal("CVE-2026-89313")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.