CVE-2026-73501: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
Vulnerability summary
CVE-2026-73501 is a critical (CVSS 9.1) Improper Authentication vulnerability in getkin kin-openapi. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.
Severe, CVSS 9.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · Red hatEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · GoEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
Decrease -0.16 pp
From 0.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- golang-github-getkin-kin-openapiAll versions (No fix recorded)
Getkin1 product
- kin-openapi< 0.144.0
Github.com/getkin1 product
- kin-openapi< 0.144.0
Redhat1 product
- grafana13.1< 0:13.1.3-0.2.hum1
Ubuntu1 product
- golang-github-getkin-kin-openapiAll versions (No fix recorded)
5 vendors · 5 products
References
14 links- github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqwX Refsource CONFIRMARTICLEREPORTWEBAdvisory
- github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985daX Refsource MISCARTICLEREPORTWEBFIX
- images.redhat.comARTICLE
