Improper Authentication in kin-openapi - CVE-2026-73501
Published: July 30, 2026 / Updated: August 13, 2026
Vulnerability identifier: #VU140574
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73501
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and access protected endpoints.
The vulnerability exists due to improper authentication in ValidationHandler.Load() when initializing request validation with a nil AuthenticationFunc. A remote attacker can send an unauthenticated request to bypass authentication and access protected endpoints.
Only applications that rely on ValidationHandler to enforce OpenAPI security requirements and do not explicitly set AuthenticationFunc are vulnerable.
Affected software
kin-openapi
How to mitigate CVE-2026-73501
Install security update from vendor's website.
kin-openapi - update to 0.144.0