CVE-2026-100351 Details
Description
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.
A vulnerability in the Kin-OpenAPI library, specifically in the ValidationHandler component, allows for authentication bypass through encoded path manipulation. This issue is present in versions 0.144.0 prior to 0.147.0. The vulnerability arises when a public route and a protected parameterized route overlap after decoding, and the router is configured to use encoded paths. An unauthenticated request can be validated as public and then dispatched to a protected handler without triggering the required authentication, potentially leading to unauthorized access.
Users can update to Kin-OpenAPI version 0.147.0 or later, where this vulnerability has been fixed. Additionally, review and adjust the routing configuration to ensure that authentication requirements are properly enforced.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041 | [email protected] | Source CodeVendor |
| https://github.com/getkin/kin-openapi/releases/tag/v0.147.0 | [email protected] | Release NotesVendor |
| https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github.com/getkin/kin-openapi | >= 0.144.0, <= 0.146.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |