The vulnerability resides in JwtClaims.MarshalJSON, which constructs a Go struct at runtime with reflect.StructOf, naming each field as "A" plus the claim name. If a JWT contains an untyped claim whose name is not a valid Go identifier or duplicates another field, reflect.StructOf panics. This results in the application crashing when handling such tokens, leading to a denial of service for any user or system relying on the library. The weakness is a failure-to-sanitize input, correlating with CWE-248.

Eclipse Foundation’s Eclipse KeyPont - GOSE is affected. No specific affected version range is provided, so all releases employing the mentioned MarshalJSON implementation are potentially impacted.

The CVSS score of 6.9 indicates medium severity. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The attack vector likely involves an attacker crafting a malicious JWT claim name and delivering it to a system that uses the library. If successful, the crash provides a disruptive denial of service but does not directly expose code execution or data exfiltration capabilities.