Hi,

The following vulnerability was published for golang-github-getkin-kin-openapi.

CVE-2026-73501[0]:
| kin-openapi is a Go project for handling OpenAPI files. Prior to
| 0.144.0, ValidationHandler.Load() in
| openapi3filter/validation_handler.go silently replaces a nil
| AuthenticationFunc with NoopAuthenticationFunc, which returns nil
| without checking credentials. This substitution causes every OpenAPI
| security requirement to be satisfied for unauthenticated requests
| when an application relies on ValidationHandler as its enforcement
| middleware. The no-op callback prevents the fail-closed
| ErrAuthenticationServiceMissing path from being reached and forwards
| the request to protected handlers that may require an API key, OAuth
| token, or another security scheme. This issue is fixed in version
| 0.144.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73501
https://www.cve.org/CVERecord?id=CVE-2026-73501
[1] https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
[2] https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore