---
title: "GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default"
url: https://erroneo.us/security/ghsa/GHSA-r277-6w6q-xmqw/
description: "GHSA-r277-6w6q-xmqw (critical, Go): kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default. Summary…"
type: advisory
section: "Security Digest"
date_published: 2026-07-24
date_modified: 2026-08-14
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-r277-6w6q-xmqw"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

## Affected packages

- Go `github.com/getkin/kin-openapi` <= 0.143.0 → fixed: 0.144.0

## Details

Summary ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on ValidationHandler as its enforcement middleware. Details ValidationHandler is an HTTP middleware exported by openapi3filter that validates incoming requests and responses against a loaded OpenAPI specification. Its Load() method initialises default fields before the handler begins serving: NoopAuthenticationFunc is defined as: It always returns nil, meaning every security scheme check it handles is automatically approved. When a request arrives, ServeHTTP → before → validateRequest assembles a RequestValidationInput with the current AuthenticationFunc (now the no-op) injected into Options: Inside ValidateRequest, each security requirement calls options.AuthenticationFunc: Because f is the no-op (not nil), the ErrAuthenticationServiceMissing guard is never triggered and f(...) returns nil, clearing the security requirement. Control then proceeds to the protected handler (validationhandler.go:61-62). The critical contradiction is that callers who use ValidateRequest directly with a nil AuthenticationFunc get fail-closed behavior (ErrAuthenticationServiceMissing), while callers who use the higher-level ValidationHandler with a nil AuthenticationFunc get fail-open behavior. Since omitting AuthenticationFunc is the natural default, the majority of real-world integrations are vulnerable. Affected source file and line: openapi3filter/validationhandler.go:47–49 (commit 30e2923, tag v0.143.0). PoC Environment Step 1 — Build the Docker image From the repository root (parent of vuln-001/): The Dockerfile copies the local kin-openapi source into /kin-openapi/ inside the image and builds a Go binary (/poc-binary) from main.go. The go.mod inside the image uses a replace directive…

## Sources

- [GitHub Advisory GHSA-r277-6w6q-xmqw](https://github.com/advisories/GHSA-r277-6w6q-xmqw)
- [github.com](https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw)
- [github.com](https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da)
- [github.com](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-r277-6w6q-xmqw/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt