CVE-2026-33216: Improper Password To Jwt Assignmentcve-2026-33216-improper-password-to-jwt-assignment
Directly assigning a password variable or field to a JWT-designated struct field is dangerous. JWT fields are often assumed to be non-confidential identity tokens and are frequently serialized and exposed in monitoring endpoints or logs. This can lead to plaintext credential leakage (e.g., CVE-2026-33216 in NATS). Only assign validated identity tokens to JWT
