CVE-2026-73501Critical· 9.1▾ Midnightkin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/getkin/kin-openapi < 0.144.0Patched in:
github.com/getkin/kin-openapi 0.144.0Source: https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73502Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-48050High· 8.2Arc is an open, SQL-native time-series database for telemetry
CVE-2026-76905High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-19607Medium· 5.3A flaw was found in the first-broker-login flow of the keycloak-services component
CVE-2026-18922Critical· 9.8A flaw was found in 389 Directory Server
CVE-2025-0604Medium· 5.4A flaw was found in Keycloak