Go JWT Claims Struct Runtime Vulnerability in Eclipse Keypont
CVE-2026-89315

6.9MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Keypont - Gose
Vendor
CVE Published:
23 October 2026

What is CVE-2026-89315?

A runtime vulnerability exists in the JwtClaims.MarshalJSON function of Eclipse Keypont's Go package, where the dynamic struct creation using reflect.StructOf can lead to a panic. This occurs when field names derived from untyped JWT claims are not valid Go identifiers or when they clash with existing fields. As a result, standard JWT claim names could inadvertently trigger these conditions, jeopardizing application stability.

Affected Version(s)

Eclipse KeyPont - GOSE 0.7.3 <= 0.13.0-rc1

Eclipse KeyPont - GOSE 0 < 1.0.0-rc4

References

https://github.com/eclipse-keypont/gose/security/advisori...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eclipse Foundation Security Team
.