CVE-2026-89315
MEDIUM—CVSS v3
—CVSS v2
—
EPSS (exploit probability)
CWE-248CWE
Description
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
Affected routers (0)
No routers currently mapped to this CVE in our database.