Description

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-12T22:17:17.443Z",
  "pubdate": "2026-08-12T22:17:17.443Z",
  "executiveSummary": "A security vulnerability affecting authentication enforcement exists in kin-openapi prior to version 0.144.0.\nThe flaw involves improper handling of authentication callbacks within the validation handler component.\nSpecifically, ValidationHandler.Load() silently substitutes a nil AuthenticationFunc with NoopAuthenticationFunc, which unconditionally permits unauthenticated requests.\nThis behavior violates the fail-closed paradigm, preventing the expected ErrAuthenticationServiceMissing error state from being triggered.\nConsequently, applications relying on ValidationHandler as security middleware inadvertently satisfy all OpenAPI security requirements, allowing unauthenticated threat actors to bypass authentication mechanisms.\nThe impact includes unauthorized access to protected handlers requiring API keys, OAuth tokens, or other security schemes, exposing sensitive backend resources to unauthorized entities over the network without requiring any prior authentication privileges.",
  "technicalDetails": "The vulnerability resides in the openapi3filter/validation_handler.go file of the kin-openapi Go project, specifically within the ValidationHandler.Load() function.\nThe root cause of the issue is an insecure default fallback mechanism where a nil AuthenticationFunc is automatically replaced with NoopAuthenticationFunc instead of raising an error or rejecting the configuration.\nNoopAuthenticationFunc is engineered to return nil immediately upon invocation, effectively indicating that security requirements have been successfully satisfied without performing any validation of credentials.\nIn a secure implementation, the absence of a configured authentication service should trigger a fail-closed error path, such as the ErrAuthenticationServiceMissing condition.\nDue to this substitution, the execution flow bypasses critical authentication checks entirely.\nThe attack flow proceeds as follows: an unauthenticated attacker sends an HTTP request targeting an endpoint protected by OpenAPI security requirements; the application routes this request through the vulnerable ValidationHandler middleware; ValidationHandler.Load() invokes the fallback NoopAuthenticationFunc because no explicit authentication function was provided; the callback returns a nil error, signaling successful authentication; and the request is subsequently forwarded to protected downstream handlers that assume valid credentials like API keys or OAuth tokens have already been verified.\nThis affects all kin-openapi versions prior to 0.144.0.\nExploitation requires network exposure to the affected API endpoints and takes advantage of misconfigured or default middleware setups where the developer omitted the authentication callback.\nNo privileges or payload generation are required by the attacker, as standard requests to protected routes are implicitly trusted by the flawed validation logic."
}