Homepage

Missing Authentication for Critical Function The advisory has been revoked - it doesn't affect any version of package go-fdo-server  (opens in a new tab)

Threat Intelligence

EPSS
0.59% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-GOFDOSERVER-19399143
  • published28 Aug 2026
  • disclosed12 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 12 Aug 2026

CVE-2026-73501  (opens in a new tab)
CWE-306  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream go-fdo-server package and not the go-fdo-server package as distributed by RHEL.

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.