GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with govulncheck ./....
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on ValidationHandler as its enforcement middleware.

Details ValidationHandler is an HTTP middleware exported by openapi3filter that validates incoming requests and responses against a loaded OpenAPI specification. Its Load() method initialises default fields before the handler begins serving:

NoopAuthenticationFunc is defined as:

It always returns nil, meaning every security scheme check it handles is automatically approved.

When a request arrives, ServeHTTP → before → validateRequest assembles a RequestValidationInput with the current AuthenticationFunc (now the no-op) injected into Options:

Inside ValidateRequest, each security requirement calls options.AuthenticationFunc:

Because f is the no-op (not nil), the ErrAuthenticationServiceMissing guard is never triggered and f(...) returns nil, clearing the security requirement. Control then proceeds to the protected handler (validationhandler.go:61-62).

The critical contradiction is that callers who use ValidateRequest directly with a nil AuthenticationFunc get fail-closed behavior (ErrAuthenticationServiceMissing), while callers who use the higher-level ValidationHandler with a nil AuthenticationFunc get fail-open behavior. Since omitting AuthenticationFunc is the natural default, the majority of real-world integrations are vulnerable.

CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Sources and references

1. GitHub Advisory GHSA-r277-6w6q-xmqw github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical Go advisories · Today’s Security Digest