kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

{
  "id": "bbc6eb906bd0713405912df7f124179a36370043ea2872ab77e770d86536f4cb",
  "url": "https://osv.dev/vulnerability/GHSA-23vg-4cjm-66q5",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion",
    "summary": "## Summary `openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded `URL.Path`. The method is documented as implementing `gorilla/mux.MiddlewareFunc`, but a downstream gorilla/mux router configured with `UseEncodedPath()` selects its handler from the encoded representation (`URL.RawPath`). An unauthenticated request such as `/public%2Fstatus` can therefore be validated as an intentionally public operation (`/public/status`) and then dispatched to a protected operation (`/{id}`). The configured, rejecting `AuthenticationFunc` is never invoked, and the protected downstream handler runs. This is distinct from GHSA-r277-6w6q-xmqw. The behavior below uses an explicit authentication callback that rejects missing credentials and remains reproducible after the v0.144.0 fix for the unsafe default callback. ## Affected products - Product: `github.com/getkin/kin-openapi` - Component: `openapi3filter.ValidationHandler.Middleware` - Confirmed post-GHSA affected releases: v0.144.0, v0.145.0, and v0.146.0 - Reporter attestation: each listed release was checked out separately, the attached single-file test was copied into `openapi3filter/`, and that test passed; maintainers should independently confirm the version range - Confirmed affected development revision: `d33e44e67734dcde81b576582185e1343fb3985d` - v0.143.0 also reproduces this mechanism, but GHSA-r277-6w6q-xmqw already provides a simpler by",
    "evidence": "osv:GHSA-23vg-4cjm-66q5",
    "products": [
      {
        "name": {
          "value": "github.com/getkin/kin-openapi",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.147.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-23vg-4cjm-66q5",
      "aliases": [
        "CVE-2026-100351",
        "GHSA-23vg-4cjm-66q5"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.144.0"
                },
                {
                  "fixed": "0.147.0"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/getkin/kin-openapi",
            "purl": "pkg:golang/github.com/getkin/kin-openapi",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-23vg-4cjm-66q5/GHSA-23vg-4cjm-66q5.json"
          }
        }
      ],
      "modified": "2026-10-15T20:30:05.450347889Z",
      "provider": "osv",
      "references": [
        "https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100351",
        "https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041",
        "https://github.com/getkin/kin-openapi",
        "https://github.com/getkin/kin-openapi/releases/tag/v0.147.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-289",
          "CWE-436"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-15T16:17:31Z",
        "github_reviewed_at": "2026-10-15T20:19:20Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-100351",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 336046,
  "published_at": "2026-10-15T20:19:20+00:00"
}