CVE-2026-111641
CriticalCVSS 9.8Summary
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
Risk Assessment
The flaw allows unauthenticated attackers to obtain an administrator session and take full control of the system. This can lead to data compromise and unauthorized changes.
Recommendation
Immediately update FastapiAdmin to a patched version or secure the auto-login endpoints with authentication. Also invalidate existing sessions and audit access logs.
Other vulnerabilities in FastapiAdmin
See all- CVE-2026-111642High
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
- CVE-2026-36728Medium
The AI assistant chat function in FastapiAdmin v2.2.0 has a Markdown-based XSS vulnerability. Attackers can inject arbitrary scripts or HTML by sending a crafted chat message.
- CVE-2026-36725Medium
FastapiAdmin version v2.2.0 contains a Markdown-based XSS vulnerability in the /system/notice/create endpoint. Attackers can inject malicious JavaScript or HTML into the notice_content parameter, which will be executed in the victim's browser.
- CVE-2026-36724Medium
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) by manipulating the func field of scheduled tasks.
Original NVD description (English source)
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS