What is the CVSS score of CVE-2026-73501?

CVE-2026-73501 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of kin-openapi are affected by CVE-2026-73501?

The widely-deployed kin-openapi Go library contains a critical authentication bypass affecting API protection across many services.. A patch is available.

How to fix or mitigate CVE-2026-73501?

Within 24 hours, inventory all applications and services using getkin/kin-openapi to identify those potentially affected. Within 7 days, upgrade kin-openapi to version 0.144.0 or later and redeploy affected services. Within 30 days, audit API access logs from the past 90 days for anomalous access patterns to protected endpoints, and conduct a security review of all exposed services during the vulnerability window.

kin-openapi CVE-2026-73501

EUVD-2026-57598 CRITICAL

Improper Authentication (CWE-287)

2026-08-12 GitHub_M

Authentication Bypass Kin Openapi

9.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated remote request bypasses auth (AV:N/AC:L/PR:N/UI:N) reaching protected handlers with high confidentiality and integrity impact; no availability effect, scope unchanged as the middleware itself is the vulnerable component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 22:16 vuln.today

Analysis Generated

Aug 12, 2026 - 22:16 vuln.today

Patch available

Aug 12, 2026 - 22:03 EUVD

CVE Published

Aug 12, 2026 - 21:23 cve.org

CRITICAL 9.1

DescriptionCVE.org

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

AnalysisAI

Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify service using ValidationHandler without AuthenticationFunc

Delivery

Send unauthenticated request to protected route

Exploit

No-op auth approves security requirement

Execution

Reach protected handler

Impact

Access or modify restricted data

Access

Identify service using ValidationHandler without AuthenticationFunc

Delivery

Send unauthenticated request to protected route

Exploit

No-op auth approves security requirement

Execution

Reach protected handler

Impact

Access or modify restricted data

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target application uses openapi3filter.ValidationHandler as its authentication enforcement point for routes carrying OpenAPI security requirements (API key, OAuth, or other scheme) AND that the developer left the ValidationHandler.AuthenticationFunc field unset, causing the vulnerable Load() default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1) reflects a network-reachable, low-complexity, unauthenticated bypass with high confidentiality and integrity impact and no availability impact - internally consistent for an auth-bypass class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker identifies a Go service whose OpenAPI spec marks certain routes as requiring an API key or OAuth token but which uses ValidationHandler without a configured AuthenticationFunc. The attacker sends an ordinary HTTP request to a protected endpoint with no credentials; the no-op auth callback approves the request and the protected handler executes, returning or modifying data that should have required authentication. …
Remediation	Vendor-released patch: upgrade the github.com/getkin/kin-openapi module to v0.144.0 (fix commit f0407d53b0730280266f454b755010e7eeb985da; release https://github.com/getkin/kin-openapi/releases/tag/v0.144.0). … Detailed patch versions, workarounds, and compensating controls in full report.