CVE-2026-100351

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.144.0 through 0.146.0

Description An issue exists in the openapi3filter.ValidationHandler.Middleware where the security validation layer and the downstream request dispatcher may select different OpenAPI operations. The ValidationHandler selects an operation based on the decoded URL.Path, whereas a downstream gorilla/mux router configured with UseEncodedPath selects the handler based on the encoded URL.RawPath.

When a public exact route and a protected parameterized route use the same HTTP method and overlap after decoding, an unauthenticated remote requester can bypass authentication. By sending a request containing an encoded path separator, the request can be validated as a public operation and subsequently dispatched to a protected handler without triggering the AuthenticationFunc callback. The reachable path parameter is limited to an encoded representation that decodes to the public literal route.

Recommendations Update kin-openapi to version 0.147.0. As a temporary mitigation, ensure that any reverse proxy used before the application canonicalizes the URI before forwarding to prevent path mismatch.