CVE-2026-73501

kin-openapi vulnerability CVE-2026-73501: prior to v0.144.0, ValidationHandler.Load() silently replaced a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil and does not verify credentials. This leads to every OpenAPI security requirement being satisfied for unauthenticated req...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

EUVD-2026-57598

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

GHSA-JPCW-4WR7-C3VQ kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

GHSA-R277-6W6Q-XMQW kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Summary ValidationHandler.Load in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication due to the unconditional substitution of a nil AuthenticationFunc with a no-op function in the Load process. An attacker can gain unauthorized access to protected endpoints by sending unauthenticated requests, as...

PT-2026-76594

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.2.0 through 0.143.0 Description An unauthenticated remote denial of service exists when the openapi3filter.ValidateRequest function processes an operation that declares a content parameter where the application/json medi...

Malicious code in modiov-kin-afbau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6a6aec576e9ed6b84a41d4c536b4d49f5afd10f48b9fc99b4521c308408a30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afudsaczubfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd48b0d2620a33f49c71f7e692a7bfd04f314116ceb2461c5f9f5acae9a515f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184443 Malicious code in modiov-kin-afbaufcaducxacs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ff912c0087efe4e11ff6a12bc496608a99126131250e1a19b34525b360b519 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d306c24f85e12a32bba8f972b3a678131011133e3e531d46c06dea0e99a76c30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afudsaczu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abb163aca205098cf974cbc41c5d6e98b591fdb57ef95bba3b5969664c4edbf9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afuds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e500ac0bb902e6244d5f7bee90f0ed891400e015bc7a9fdec9837985201286d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afbaufcaducc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5999ce6f680bfae47868a925114f9a529d187e849b82a4039e2a3ba90125f41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afudsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0b359e4c6a02b047a420d4c60ec94f09089a2e12e1d5a90aa1a396ab81f0ff0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pilau-akaviu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 378047f5d90bcd7060fa530db42bc90045c9adbabfffa7234d262aa1f184b217 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polil-akilu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b0a63dd48b8df2aaae0faff83f09314095ddfdd3f83b1c287f026329b72f2ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...