CVE-2026-89313
— UNSCOREDpublic exploit availablePublished 2026-10-23 · Updated 2026-10-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Weaknesses
CWE-706
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-106181
- MEDIUMCVE-2026-106230
- HIGHCVE-2026-106274
- HIGHCVE-2026-106279
- HIGHCVE-2026-106308
- MEDIUMCVE-2026-106325
- HIGHCVE-2026-106409
- MEDIUMCVE-2026-107822PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.