{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/getkin/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kin-openapi (\u003c= v0.143.0)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","api","golang","library-vulnerability","cwe-287"],"_cs_type":"advisory","_cs_vendors":["getkin"],"content_html":"\u003cp\u003eUnauthenticated remote attackers can bypass authentication in Go services utilizing the \u003ccode\u003egetkin/kin-openapi\u003c/code\u003e library, specifically versions \u003ccode\u003ev0.143.0\u003c/code\u003e and earlier. The vulnerability stems from a logical flaw within the \u003ccode\u003eopenapi3filter.ValidationHandler\u003c/code\u003e middleware's \u003ccode\u003eLoad()\u003c/code\u003e method. When this handler is initialized without an explicitly defined \u003ccode\u003eAuthenticationFunc\u003c/code\u003e, it defaults to \u003ccode\u003eNoopAuthenticationFunc\u003c/code\u003e, which unconditionally returns success for all security checks. This oversight allows attackers to access API endpoints declared as protected by OpenAPI security requirements (e.g., API keys, OAuth tokens) without providing any valid credentials. The issue, tracked as GHSA-r277-6w6q-xmqw, primarily impacts Go applications that rely on \u003ccode\u003eValidationHandler\u003c/code\u003e for API security enforcement, potentially leading to unauthorized data access and integrity compromise. The flaw is particularly critical because the insecure behavior is the default when developers omit the \u003ccode\u003eAuthenticationFunc\u003c/code\u003e field.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target Go service that uses \u003ccode\u003eopenapi3filter.ValidationHandler\u003c/code\u003e from \u003ccode\u003egetkin/kin-openapi\u003c/code\u003e (versions \u0026lt;= v0.143.0) and does not explicitly set an \u003ccode\u003eAuthenticationFunc\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker sends an unauthenticated HTTP GET request to a protected API endpoint (e.g., \u003ccode\u003e/secret\u003c/code\u003e) as defined by the service's OpenAPI specification, omitting any required authentication headers or tokens.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eValidationHandler\u003c/code\u003e middleware intercepts the incoming HTTP request.\u003c/li\u003e\n\u003cli\u003eDuring the middleware's initialization or request processing, if \u003ccode\u003eh.AuthenticationFunc\u003c/code\u003e is \u003ccode\u003enil\u003c/code\u003e, the \u003ccode\u003eValidationHandler.Load()\u003c/code\u003e method silently replaces it with \u003ccode\u003eNoopAuthenticationFunc\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eValidateRequest\u003c/code\u003e function within the middleware proceeds to invoke the \u003ccode\u003eNoopAuthenticationFunc\u003c/code\u003e for any security requirements specified in the OpenAPI document for the requested endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eNoopAuthenticationFunc\u003c/code\u003e always returns \u003ccode\u003enil\u003c/code\u003e, effectively signaling successful authentication without performing any actual credential checks.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eValidationHandler\u003c/code\u003e forwards the now \u0026quot;authenticated\u0026quot; (but actually unauthenticated) request to the application's underlying handler responsible for the protected endpoint.\u003c/li\u003e\n\u003cli\u003eThe application's handler processes the request and returns the sensitive or protected resource to the attacker, bypassing all intended security controls.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis is an authentication bypass vulnerability (CWE-287) with critical severity. Any Go application that employs \u003ccode\u003eopenapi3filter.ValidationHandler\u003c/code\u003e as its HTTP middleware, specifies \u003ccode\u003esecurity\u003c/code\u003e requirements in its OpenAPI definition, and fails to explicitly configure the \u003ccode\u003eAuthenticationFunc\u003c/code\u003e is fully vulnerable. An unauthenticated remote attacker can successfully interact with otherwise protected API endpoints, circumventing authentication mechanisms like API keys or OAuth tokens. This direct access to secured resources critically compromises the confidentiality and integrity of data and operations managed by those endpoints. Developers following common integration patterns are particularly susceptible, as the insecure behavior is the default and silent.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eUpdate the \u003ccode\u003egetkin/kin-openapi\u003c/code\u003e library to a patched version immediately.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExplicitly set \u003ccode\u003eh.AuthenticationFunc\u003c/code\u003e within your \u003ccode\u003eopenapi3filter.ValidationHandler\u003c/code\u003e configuration to a custom authentication function.\u003c/strong\u003e This remediates the vulnerability by preventing the silent substitution with \u003ccode\u003eNoopAuthenticationFunc\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview application logs for any anomalous access patterns to API endpoints that are typically protected, especially requests lacking expected authentication headers or tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:56:23Z","date_published":"2026-07-24T16:56:23Z","id":"https://feed.craftedsignal.io/briefs/2026-07-kin-openapi-auth-bypass/","summary":"An authentication bypass vulnerability (CWE-287) exists in the `openapi3filter.ValidationHandler` component of the `getkin/kin-openapi` library (versions \u003c= v0.143.0), where the `ValidationHandler.Load()` method silently defaults to a `NoopAuthenticationFunc` when an explicit function is not provided, allowing unauthenticated remote attackers to bypass OpenAPI security requirements and access protected endpoints in Go services.","title":"Authentication Bypass in kin-openapi Due to Default NoopAuthenticationFunc","url":"https://feed.craftedsignal.io/briefs/2026-07-kin-openapi-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Getkin","version":"https://jsonfeed.org/version/1.1"}