Read the docs
TI-2026-79584 Aliases CVE-2026-89313

Eclipse KeyPont - GOSE returns wrong key when kid is missing

Priority MEDIUM 61CWE-706Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Eclipse KeyPont - GOSE versions from 0.7.5 through 0.13.0-rc1 and from 0 before 1.0.0-rc4 are affected. In JwksTrustStore.Get, parsed keys are assigned to a named return value, so when the requested kid is absent, the function returns the last key in the JWKS document with a nil error (CWE-706). The CVSS vector rates this as remotely reachable without privileges or user interaction, with low integrity impact. CISA's SSVC assessment lists exploitation as proof of concept.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix Fixed Eclipse KeyPont - GOSE (Eclipse Foundation): 1.0.0-rc4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse KeyPont - GOSE0.7.5 – 0.13.0-rc1—No fix listedCNA
Eclipse FoundationEclipse KeyPont - GOSEbefore 1.0.0-rc41.0.0-rc4Patch availableCNA
  • Eclipse KeyPont - GOSE VendorEclipse Foundation Affected 0.7.5 – 0.13.0-rc1 Fixed in — No fix listed CNA
  • Eclipse KeyPont - GOSE VendorEclipse Foundation Affected before 1.0.0-rc4 Fixed in 1.0.0-rc4 Patch available CNA

Remediation

Upgrade Eclipse KeyPont - GOSE to 1.0.0-rc4, which fixes the flaw. The sources list no fix for the 0.7.5 through 0.13.0-rc1 range.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA Eclipse KeyPont - GOSE (Eclipse Foundation) Fixed in 1.0.0-rc4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Eclipse KeyPont - GOSE 1.0.0-rc4

    7 records Highest priority Priority HIGH 3 HIGH, 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-79602 Panic on malformed JWE IV length in Eclipse KeyPont GOSEPriority HIGH 70
    • TI-2026-79599 Panic in Eclipse KeyPont - GOSE JWT claim marshallingPriority HIGH 70
    • TI-2026-79598 Slow duplicate key_ops check in Eclipse KeyPont GOSE exhausts CPUPriority HIGH 70
    Show all 7 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-89313
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences