Kin-openapi 0.147.0 patches high-severity authentication bypass in Go library

The GitHub advisory GHSA-23vg-4cjm-66q5 details a high-severity vulnerability in the kin-openapi Go package. Version 0.147.0 resolves the issue, which allows unauthenticated remote access to protected API endpoints.

What happened

The vulnerability, tracked as CVE-2026-100351, exists in the `openapi3filter.ValidationHandler.Middleware` component of the `github.com/getkin/kin-openapi` package. According to the GitHub advisory, the flaw affects versions 0.144.0, 0.145.0, and 0.146.0. The issue arises from a mismatch between how the middleware validates requests and how downstream routers interpret URL paths.

The middleware uses kin-openapi’s legacy router to select an OpenAPI operation based on the decoded `URL.Path`. However, if a downstream router like `gorilla/mux` is configured with `UseEncodedPath()`, it selects the handler from the encoded `URL.RawPath`. This discrepancy allows an attacker to send a request such as `/public%2Fstatus`.

The middleware validates this request against the intentionally public operation `/public/status`. Meanwhile, the downstream router dispatches the request to a protected operation, such as `/{id}`. Because the validation passes against the public route, the configured `AuthenticationFunc` is never invoked. The protected downstream handler then executes without requiring credentials.

This behavior is distinct from a previous advisory, GHSA-r277-6w6q-xmqw. The current issue uses an explicit authentication callback that rejects missing credentials. It remains reproducible even after the v0.144.0 fix for the unsafe default callback. The reporter confirmed the vulnerability in development revision `d33e44e67734dcde81b576582185e1343fb3985d`.

Version 0.143.0 also reproduces this mechanism, but the previous advisory already provided a simpler bypass for that release. The distinct post-fix claim starts at v0.144.0. Earlier releases were not tested, so the introduction boundary remains unknown. The fix is available in version 0.147.0.

Why it matters

This vulnerability allows unauthenticated remote requesters to reach handlers that require authentication. This occurs only when the application uses `ValidationHandler.Middleware` as the security gate and the downstream router preserves and interprets an encoded path. Teams using `gorilla/mux` with `UseEncodedPath()` are particularly exposed to this bypass technique.

The flaw undermines the security model of APIs relying on kin-openapi for validation. Attackers can access protected resources without triggering authentication checks. This could lead to unauthorized data access or system manipulation. The high severity rating reflects the ease of exploitation and the potential impact on protected endpoints.

What to watch

• Monitor for new advisories related to kin-openapi path handling.
• Check if downstream routers interpret encoded paths differently than the middleware.
• Review API access logs for requests with percent-encoded characters.
• Verify that authentication callbacks are invoked for all protected routes.

Who needs to act first

Teams should prioritize updating systems that expose public APIs using kin-openapi. Check whether your application uses `ValidationHandler.Middleware` with routers that handle encoded paths. Roll out the 0.147.0 update to production environments after testing in a staging area. Back up current configurations before applying the patch. If immediate updating is not possible, monitor traffic for suspicious encoded path requests. Consider adding additional authentication layers at the network level to mitigate exposure until the fix is deployed.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe: kin-openapi

• Update the kin-openapi package to version 0.147.0 or later in all affected applications.
• Audit your API gateways for any custom middleware that might bypass authentication checks.
• Review logs for requests containing percent-encoded characters that might indicate exploitation attempts.
• Ensure that all downstream routers are configured to handle path encoding consistently with the middleware.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of kin-openapi are affected by CVE-2026-100351?

Versions 0.144.0, 0.145.0, and 0.146.0 are confirmed affected. Version 0.143.0 also reproduces the mechanism but has a simpler bypass covered by a previous advisory.

Is there a fix available for this vulnerability?

Yes, version 0.147.0 of the kin-openapi package patches the vulnerability.

How does the authentication bypass work?

The middleware validates requests against the decoded path, while the downstream router uses the encoded path. This mismatch allows public requests to be routed to protected handlers without triggering authentication.