Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
kin-openapi lets any request bypass authentication
published 2 months ago
Summary
The kin-openapi library used to process OpenAPI files could replace a missing authentication check with a do‑nothing function. As a result, requests that should have been blocked for missing credentials were allowed through, potentially exposing protected APIs. Upgrade to version 0.144.0 or later to ensure proper authentication is enforced.
What to do
- Update getkin github.com/getkin/kin-openapi to version 0.144.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Go | getkin | github.com/getkin/kin-openapi |
< 0.144.0 Fix: upgrade to 0.144.0
|
Original advisory text
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthen...
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-287Improper Authentication
Timeline
Published12 Aug 2026
Updated10 Sep 2026
First seen25 Jul 2026
Sources
GHSA-r277-6w6q-xmqw · OSV
Track software like this
Free during beta