CVE-2026-73501: kin-openapi Auth Bypass Vulnerability

CVE-2026-73501 Overview

CVE-2026-73501 is an authentication bypass vulnerability in kin-openapi, a widely used Go library for parsing and validating OpenAPI 3 specifications. Versions prior to 0.144.0 contain a flaw in ValidationHandler.Load() located in openapi3filter/validation_handler.go. The function silently substitutes a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without verifying any credentials. Applications that depend on ValidationHandler as enforcement middleware treat every OpenAPI security requirement as satisfied for unauthenticated requests. This weakness maps to [CWE-287: Improper Authentication] and is fixed in version 0.144.0.

Critical Impact
Unauthenticated attackers can invoke protected handlers requiring API keys, OAuth tokens, or other security schemes without providing valid credentials.

Affected Products

getkin/kin-openapi Go module versions prior to 0.144.0
Any Go HTTP service using openapi3filter.ValidationHandler as its security enforcement middleware
Downstream applications and APIs relying on OpenAPI security requirements enforced solely by kin-openapi

Discovery Timeline

2026-08-12 - CVE-2026-73501 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73501

Vulnerability Analysis

The defect lives in the initialization logic of ValidationHandler.Load(). When developers construct a ValidationHandler without explicitly assigning an AuthenticationFunc, the library silently installs NoopAuthenticationFunc as the default. That callback returns nil for every invocation, signaling successful authentication regardless of the request contents.

As a result, every securityRequirements block defined in the OpenAPI document evaluates as satisfied. Requests missing API keys, bearer tokens, OAuth credentials, or mutual TLS assertions still reach the protected handler chain. The failure is silent, produces no warning at startup, and cannot be detected through normal application logs.

The issue affects confidentiality and integrity of any endpoint whose sole enforcement mechanism is the OpenAPI validation middleware. Applications that layer additional authentication middleware in front of ValidationHandler are not exposed.

Root Cause

The root cause is an insecure default: substituting a nil authentication callback with a no-op instead of failing closed. The correct fail-closed path, ErrAuthenticationServiceMissing, is never reached because the substitution occurs before the security requirement evaluation loop executes.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to any endpoint documented in the OpenAPI specification. Because the no-op function reports success, ValidationHandler forwards the request to downstream handlers as if the caller possessed valid credentials. No specialized tooling, authentication artifacts, or user interaction is required.

 	if h.Handler == nil {
 		h.Handler = http.DefaultServeMux
 	}
-	if h.AuthenticationFunc == nil {
-		h.AuthenticationFunc = NoopAuthenticationFunc
-	}
+	// NOTE: users MUST set AuthenticationFunc explicitly or expect ErrAuthenticationServiceMissing when verifying SecurityRequirements
 	if h.ErrorEncoder == nil {
 		h.ErrorEncoder = DefaultErrorEncoder
 	}
// Source: https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da

The patch removes the silent default assignment. Callers must now explicitly assign an AuthenticationFunc or accept the fail-closed ErrAuthenticationServiceMissing error at runtime.

Detection Methods for CVE-2026-73501

Indicators of Compromise

HTTP 2xx responses to protected endpoints from clients that never present authentication headers such as Authorization, X-API-Key, or session cookies
Access log entries showing successful invocations of endpoints protected by securitySchemes from unauthenticated source IP addresses
Absence of ErrAuthenticationServiceMissing events in application logs despite the presence of securityRequirements in the OpenAPI spec

Detection Strategies

Inventory Go build manifests (go.mod, go.sum) for github.com/getkin/kin-openapi versions below 0.144.0
Perform runtime black-box testing by issuing unauthenticated requests to endpoints defined with security requirements and confirming they are rejected
Use software composition analysis (SCA) tools to flag vulnerable module versions in CI pipelines and container images

Monitoring Recommendations

Alert on protected API endpoint invocations lacking expected authentication headers or claims
Track anomalous spikes in traffic to endpoints that should require authentication but return non-error responses
Correlate ingress logs with authentication service logs to identify requests that reached backends without a corresponding credential validation event

How to Mitigate CVE-2026-73501

Immediate Actions Required

Upgrade github.com/getkin/kin-openapi to version 0.144.0 or later across all Go services
Audit every construction of openapi3filter.ValidationHandler and openapi3filter.Options to confirm AuthenticationFunc is explicitly assigned
Add integration tests that send unauthenticated requests to protected endpoints and assert rejection responses

Patch Information

The fix is included in kin-openapi Release v0.144.0. The upstream commit is documented in the GitHub commit update and the coordinated disclosure appears in GitHub Security Advisory GHSA-r277-6w6q-xmqw. After upgrading, callers must explicitly set AuthenticationFunc; otherwise the library returns ErrAuthenticationServiceMissing when evaluating security requirements.

Workarounds

Place an independent authentication middleware in front of ValidationHandler so credential validation does not depend on the OpenAPI filter
Explicitly assign a custom AuthenticationFunc that validates credentials and returns a non-nil error on failure
Temporarily remove securityRequirements from the OpenAPI spec only if enforcement is guaranteed by an upstream gateway or reverse proxy

bash

# Upgrade the vulnerable dependency to the patched release
go get github.com/getkin/kin-openapi@v0.144.0
go mod tidy

# Verify the resolved version
go list -m github.com/getkin/kin-openapi