CVE-2026-73501

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.144.0

Description In the ValidationHandler.Load() function within openapi3filter/validation handler.go, a nil AuthenticationFunc is silently replaced with NoopAuthenticationFunc. This function returns nil without verifying credentials, causing all OpenAPI security requirements to be satisfied for unauthenticated requests when ValidationHandler is used as enforcement middleware. This behavior bypasses the fail-closed ErrAuthenticationServiceMissing path, allowing requests to reach protected handlers that should require an API key, OAuth token, or other security schemes.

Recommendations Update to version 0.144.0.