Kin-openapi, a Go library that parses OpenAPI files, allowed a mismatch between the operation selected by the ValidationHandler and the operation dispatched by a gorilla/mux router when the router was configured with UseEncodedPath. The handler uses the decoded URL.Path to validate, while the router can dispatch based on the raw, encoded path. An attacker can send a request whose encoded path contains a separator that, when decoded, matches a public route but actually maps to a protected, parameterized route. The request is therefore validated as public but routed to a protected handler without invoking the configured AuthenticationFunc, resulting in unauthorized access to the protected endpoint. This flaw is a classic broken authentication or authorization issue, captured by CWE-289 and CWE-436.

The vulnerability applies to the getkin:kin-openapi library between versions 0.144.0 and 0.146.x (up to 0.147.0). Systems that use this library to enforce OAuth or other authentication mechanisms in HTTP APIs are affected.

The CVSS score is 7.4, indicating moderate to high severity. While a specific EPSS score is not available, the vulnerability requires crafting a precise encoded URL and relying on the target application to route the request to the library and then to gorilla/mux. This suggests a reasonable attack surface for exposed web services but a lower probability compared to generic remote code execution. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit it remotely via HTTP requests containing an encoded path separator to bypass authentication.