When the requested key identifier is not present, the JwksTrustStore.Get function returns the most recent key from the JWKS document together with a nil error. This logic flaw means that calls to the function receive a valid cryptographic key even though the requested key does not exist, allowing a caller to validate a token signed with an unexpected key. The attack vector is inferred from the description, as an attacker could manipulate a JWT header with a non‑existent kid field. The resulting effect is that a malicious actor can supply a JSON Web Token with a non‑existent kid field and have it accepted as valid, enabling unauthorized access or privilege escalation. The vulnerability is classified as a control‑flow issue (CWE‑706).

The flaw resides in Eclipse KeyPont GOSE, a component distributed by the Eclipse Foundation. Specific product versions affected are not listed in the advisory, so any environment using any released version of this library is potentially impacted until a fix is published. The affected product scope is inferred from the vendor/product name, and specific version details are missing.

The CVSS score of 6.3 indicates moderate severity. The exploitation path is inferred from the description, involving manipulation of the JWT header. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exploitation requires only the manipulation of a JWT header and the use of the vulnerable library. Because it directly influences authentication, the risk is high for systems that rely on the library for token verification, and because the exploit path is simple, the potential attack surface is broad.