Authentication Bypass in kin-openapi by getkin

CVE-2026-73501

What is CVE-2026-73501?

In kin-openapi, an issue was identified in the ValidationHandler.Load() function prior to version 0.144.0. This vulnerability arises when a nil AuthenticationFunc is replaced with a NoopAuthenticationFunc, inadvertently allowing unauthenticated requests to bypass security requirements. As a result, any OpenAPI security measures put in place may not be enforced, exposing applications to risks even when security tokens or API keys are expected. The vulnerability was rectified in version 0.144.0, enhancing the security of OpenAPI handling.

References