The flaw in kin-openapi’s ValidationHandler.Load() causes a nil AuthenticationFunc to be silently replaced with NoopAuthenticationFunc, which simply returns nil and never verifies credentials. As a result, every OpenAPI security requirement is considered satisfied for unauthenticated requests, allowing attackers to reach protected endpoints that normally require an API key, OAuth token, or other credential. This represents a classic authentication bypass (CWE-287) and could expose sensitive data or services to unauthenticated access.

The vulnerability affects the getkin:kin-openapi package. Versions prior to v0.144.0 are impacted; v0.144.0 and later include a fix. Any deployment that relies on ValidationHandler as its middleware and has not yet upgraded is susceptible.

The CVSS score of 9.1 indicates critical severity, and an EPSS score is not available, so the precise exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending unauthenticated HTTP requests to endpoints protected by kin-openapi’s ValidationHandler. If the application does not provide a custom AuthenticationFunc, the default noop function will allow the request to pass through, bypassing the intended security checks.