CVE-2026-73501

Received Received - Intake

Authentication Bypass in kin-openapi OpenAPI Validation

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73501

Affected Vendors & Products

Vendor	Product	Version / Range
kin-openapi	kin-openapi	to 0.144.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects kin-openapi, a Go library for OpenAPI file handling. Before version 0.144.0, the ValidationHandler.Load() function replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without validating credentials. This causes unauthenticated requests to bypass security requirements, allowing access to protected endpoints.

Detection Guidance

Detection requires checking if your Go application uses kin-openapi versions before 0.144.0 and relies on ValidationHandler for authentication. Inspect dependency files like go.mod for kin-openapi version. No direct commands detect exploitation, but monitoring for unauthorized access attempts may indicate misuse.

Impact Analysis

If you use kin-openapi versions before 0.144.0 as an enforcement middleware, attackers could bypass authentication and access sensitive endpoints without valid credentials. This could lead to unauthorized data access or modification.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict authentication for sensitive data access, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized access risks non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade kin-openapi to version 0.144.0 or later. Review applications using ValidationHandler to ensure proper authentication enforcement. Replace any nil AuthenticationFunc with a custom function that validates credentials as intended.

Hi! I’m here to help you understand CVE-2026-73501. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70