Fail-open authentication bypass in getkin/kin-openapi ValidationHandler (CVE-2026-73501)

ValidationHandler.Load() in the kin-openapi Go library unconditionally replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. This causes every OpenAPI security requirement to be silently satisfied for unauthenticated requests, allowing an unauthenticated remote attacker to reach handlers that require an API key, OAuth token, or other security scheme when the application uses ValidationHandler as its enforcement middleware. Affected versions: - <= v0.143.0 We recommend updating to: v0.144.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw Details: https://vuln.today/cve/CVE-2026-73501