DailyCVE@dailycve
🔴 kin-openapi, Path Confusion Route Bypass, #CVE-2026-73501 (critical) -DC-Oct2026-3255 https://dailycve.com/kin-openapi-path-confusion-route-bypass-cve-2026-73501-critical-dc-oct2026-3255/
0000013
242 followersView on X
CVE-2026-73501
LOWCVSS 9.1 · CRITICALSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-287
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day