CVE-2026-100351
Deferred Deferred - Pending Action

Authentication Bypass in kin-openapi via Path Validation

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-100351
EUVD
EUVD-2026-102160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi >= 0.144.0, < 0.147.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the kin-openapi Go library between versions 0.144.0 and 0.147.0. It involves a mismatch between path validation and routing when encoded path separators (like %2F) are used. The ValidationHandler validates requests using decoded paths but dispatches them based on encoded paths, allowing unauthenticated requests to bypass authentication for protected routes if specific conditions are met.

Detection Guidance

Check if your application uses kin-openapi versions between 0.144.0 and 0.146.0. Inspect the dependency tree for the kin-openapi package. Test with encoded path separators like %2F in URLs to see if protected routes are accessible without authentication.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to protected endpoints without proper authentication. Attackers could manipulate encoded paths to bypass security checks, potentially leading to confidentiality or integrity breaches if the protected handler has such authority. The impact depends on the application's use of the library and its routes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (data confidentiality) and HIPAA (protected health information integrity). Organizations using affected versions may face compliance violations if the vulnerability is exploited to access restricted data.

Mitigation Strategies

Upgrade kin-openapi to version 0.147.0 or later. Review router configurations to ensure consistent path handling between validation and dispatching. Avoid using UseEncodedPath in gorilla/mux if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100351. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart