Request validation does not work properly in case request schema is an object "derived" from other object using allOf about openapi-core

[stojan-jovic]

I experienced this also for the simple object validation (not only "derived").
Probably you are right that this is bug in the lib, at least according to the official page, but workaround would be to explicitly use additionalProperties: false, for example for capabilities object:

capabilities:
  type: object
  properties:
    capability_1:
      type: string
    capability_2:
      type: string
  additionalProperties: false

And fix in the lib should be very simple, I would say.