Vulnerability Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb
- https://github.com/getkin/kin-openapi/releases/tag/v0.144.0
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
FAQ
What is CVE-2026-73501?
CVE-2026-73501 is a vulnerability with a CVSS score of 9.1 (CRITICAL). kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthentic...
How severe is CVE-2026-73501?
CVE-2026-73501 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-73501?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.