TI-2026-75427 Aliases CVE-2026-111641 GHSA-xj6f-6mc4-xhqp

Authentication bypass in FastapiAdmin via auto-login endpoints

MEDIUM 48CWE-306Published 2026-10-16 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

FastapiAdmin through 3.0 contains an authentication bypass in its auto-login endpoints, which lack authentication checks (CWE-306). An unauthenticated remote attacker can list users, obtain a superuser auto-login token, and exchange it for a JWT session with full administrative control.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00433 37th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastapiadmin	FastapiAdmin	up to 3.0	—	No fix listed	CNA

FastapiAdmin Vendorfastapiadmin Affected up to 3.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for FastapiAdmin.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-16 Threatist record created from CVE-2026-111641
2026-10-16 Alias added: GHSA-xj6f-6mc4-xhqp
2026-10-18 CISA SSVC decision points changed

References

Advisory 1

https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret

Other 1

https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L173-L251

TI-2026-75428 Hard-coded JWT secret in FastapiAdmin allows privilege escalation CVSS 4.0HIGH 8.7
TI-2026-02567 FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure CVSS 4.0MEDIUM 6.9
TI-2026-02571 FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload CVSS 4.0MEDIUM 5.3
TI-2026-02570 FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload CVSS 4.0MEDIUM 5.3
TI-2026-02569 FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload CVSS 4.0MEDIUM 5.3
TI-2026-02568 FastApiAdmin Download Endpoint controller.py download_controller information disclosure CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences