Executive brief
kin-openapi is a Go library for parsing and validating OpenAPI specifications. Applications using it to enforce API security can be bypassed—unauthenticated requests will pass security checks if the application fails to configure an authentication function, allowing attackers to access protected endpoints without valid credentials.
Technical details
The vulnerability is an authentication bypass in ValidationHandler.Load() (openapi3filter/validation_handler.go) that silently substitutes a nil AuthenticationFunc with NoopAuthenticationFunc, which unconditionally returns nil without verifying credentials. This prevents the fail-closed ErrAuthenticationServiceMissing error path from being triggered, causing all OpenAPI security requirements to be satisfied for unauthenticated requests. Affected applications must have configured ValidationHandler as their enforcement middleware and failed to provide a custom authentication function. An attacker can send requests without authentication credentials to bypass API key, OAuth token, or other configured security schemes. The issue is resolved in version 0.144.0.
Affected products
- getkin kin-openapi before 0.144.0
Timeline
- 2026-08-12: disclosed
- 2026-07-23: patched: Fixed in version 0.144.0