CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

• CWE-287

• https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw

Published

Aug 12, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73496MCP Atlassian is a Model Context Protocol (MCP) server for A…7.7
• CVE-2026-73497MCP Atlassian is a Model Context Protocol (MCP) server for A…6.5
• CVE-2026-73498MCP Atlassian is a Model Context Protocol (MCP) server for A…7.7
• CVE-2026-73499etcd is a distributed key-value store for the data of a dist…7.1
• CVE-2026-7350Use after free in WebMIDI in Google Chrome prior to 147.0.77…8.3
• CVE-2026-73500etcd is a distributed key-value store for the data of a dist…8.7
• CVE-2026-73502kin-openapi is a Go project for handling OpenAPI files. From…5.3
• CVE-2026-73505Oh My Posh is the most customisable and low-latency cross pl…7.8
• CVE-2026-73506Oh My Posh is the most customisable and low-latency cross pl…6.1
• CVE-2026-73507Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73508Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73509OpenList a file list program that supports multiple storage.…7.6