Executive brief
A vulnerability in the kin-openapi Go library allows unauthenticated users to bypass security checks on protected API endpoints. The library's request validation middleware incorrectly defaults to a 'no-operation' authentication mode when no specific security function is provided, effectively treating all requests as pre-authorized. This could allow attackers to access sensitive data or perform unauthorized actions on services that rely on this library for security enforcement.
Technical details
The vulnerability exists in the `openapi3filter.ValidationHandler` middleware. When the `Load()` method is called, it checks if `AuthenticationFunc` is nil; if so, it unconditionally assigns `NoopAuthenticationFunc`. This function always returns a nil error, causing the underlying `ValidateRequest` logic to treat all security requirements (API keys, OAuth2, etc.) as satisfied. While direct calls to `ValidateRequest` fail-closed when the authentication function is missing, the higher-level `ValidationHandler` fails-open. An unauthenticated remote attacker can exploit this by sending requests to endpoints that should require credentials. The issue is fixed in version 0.144.0 by removing the automatic assignment of the no-op function.
Affected products
- getkin kin-openapi <= 0.143.0
Timeline
- 2026-07-23: advisory: Initial GitHub Advisory published
- 2026-07-24: disclosed: Advisory updated with full details
- 2026-07-24: patched: Version 0.144.0 released
References
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
- https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da
- https://github.com/getkin/kin-openapi/releases/tag/v0.144.0
- https://api.github.com/repos/getkin/kin-openapi/security-advisories/GHSA-r277-6w6q-xmqw