Search: CVE-2026-100351

CVE-2026-100351 is an authentication bypass vulnerability in the kin-openapi library's openapi3filter.ValidationHandler.Middleware. It arises when a downstream gorilla/mux router uses UseEncodedPath(), causing a mismatch between the decoded path used for validation and the encoded path used for routing. This allows an unauthenticated request with an encoded path to bypass authentication and reach a protected handler. The issue affects kin-openapi versions from 0.144.0 up to but not including 0.147.0. The vulnerability can lead to unauthorized execution of protected handlers without invoking the authentication callback.