Skip to content
Threat Feed
Subscribe

Tag

Cwe-287

2 briefs RSS
critical advisory

Authentication Bypass in kin-openapi Due to Default NoopAuthenticationFunc

An authentication bypass vulnerability (CWE-287) exists in the `openapi3filter.ValidationHandler` component of the `getkin/kin-openapi` library (versions <= v0.143.0), where the `ValidationHandler.Load()` method silently defaults to a `NoopAuthenticationFunc` when an explicit function is not provided, allowing unauthenticated remote attackers to bypass OpenAPI security requirements and access protected endpoints in Go services.

kin-openapi authentication-bypass api golang library-vulnerability cwe-287
1t
high advisory

meta-ads-mcp Authentication Bypass via X-Pipeboard-Token Header

An authentication bypass vulnerability in `meta-ads-mcp` version 1.0.113 allows unauthenticated network callers to gain unauthorized access by sending an arbitrary value in the `X-Pipeboard-Token` HTTP header, leading to the reuse of the server operator's `META_ACCESS_TOKEN` for full read and write access to Meta Ads data.

meta-ads-mcp authentication-bypass web-vulnerability meta python cwe-287
3t