Improper Authentication in kin-openapi - #VU140574
Published: July 30, 2026
Vulnerability identifier: #VU140574
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and access protected endpoints.
The vulnerability exists due to improper authentication in ValidationHandler.Load() when initializing request validation with a nil AuthenticationFunc. A remote attacker can send an unauthenticated request to bypass authentication and access protected endpoints.
Only applications that rely on ValidationHandler to enforce OpenAPI security requirements and do not explicitly set AuthenticationFunc are vulnerable.
Affected software
kin-openapi
Remediation
Install security update from vendor's website.
kin-openapi - update to 0.144.0