critical · 9.1Jul 24, 2026

kin-openapi: ValidationHandler Fail-Open Authentication Bypass

Rohit Hatagale
AI Security Researcher, SecureLayer7

The kin-openapi HTTP validation middleware silently skips all credential checks by default, letting unauthenticated requests through to routes your OpenAPI spec marks as protected.

Packagegithub.com/getkin/kin-openapi
Ecosystemgo
Affected<= 0.143.0
Fixed in0.144.0
kin-openapi: ValidationHandler Fail-Open Authentication Bypass

The problem

In kin-openapi up to and including v0.143.0, ValidationHandler.Load() replaces a nil AuthenticationFunc with the built-in NoopAuthenticationFunc, which unconditionally returns nil for every security scheme check.

This creates a dangerous gap: callers who use ValidateRequest directly with no AuthenticationFunc get a hard error (ErrAuthenticationServiceMissing), while callers who use the higher-level ValidationHandler with no AuthenticationFunc get silent pass-through.

Omitting AuthenticationFunc is the natural default, so every real-world integration that relies on ValidationHandler as its auth enforcement layer is exposed.

Proof of concept

A working proof-of-concept for this issue in github.com/getkin/kin-openapi, with the exact payload below.

http
GET /secret HTTP/1.1
Host: example.test
# X-Api-Key header intentionally absent
# OpenAPI spec declares: security: [{apiKey: []}] on GET /secret
# ValidationHandler has no AuthenticationFunc set (nil)
# Load() injects NoopAuthenticationFunc -> returns nil -> 200 OK + secret body returned

The root cause is the three-line block in openapi3filter/validation_handler.go (commit 30e2923, tag v0.143.0) that runs unconditionally during Load():

``go if h.AuthenticationFunc == nil { h.AuthenticationFunc = NoopAuthenticationFunc } ``

NoopAuthenticationFunc is defined as func(context.Context, *AuthenticationInput) error { return nil }. It always returns nil, so every call to f(ctx, &AuthenticationInput{...}) inside ValidateRequest succeeds without any credential check. Because f is not nil, the fail-closed guard (if f == nil { return ErrAuthenticationServiceMissing }) is never reached, and the request is forwarded to the protected handler.

The fix removes those three lines entirely. A nil AuthenticationFunc now propagates into ValidateRequest, which hits the fail-closed path and rejects the request. This is CWE-287 (Improper Authentication), specifically a fail-open default.

The fix

Upgrade to github.com/getkin/kin-openapi v0.144.0. After the patch, ValidationHandler.Load() no longer injects NoopAuthenticationFunc. If you genuinely want to skip authentication checks, set the field explicitly: h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc.

Any application that relied on the implicit noop must now supply a real implementation or opt in consciously.

Reporter not attributed.

References: [1][2][3][4]

Related research