CVE-2026-73501Critical· 9.1▾ Midnightkin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.6%
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/getkin/kin-openapi < 0.144.0Patched in:
github.com/getkin/kin-openapi 0.144.0Source: https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73502Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-76905High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-48050High· 8.2Arc is an open, SQL-native time-series database for telemetry
CVE-2026-114126High· 8.8storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token (CVE-2026-114126)
CVE-2025-0604Medium· 5.4A flaw was found in Keycloak
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)