CVE-2026-111641

CRITICAL 9.8

FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

CWE	CWE-306
Vendor	fastapiadmin
Product	fastapiadmin
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for fastapiadmin fastapiadmin

Be the first to know when new critical vulnerabilities affecting fastapiadmin fastapiadmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

fastapiadmin / FastapiAdmin

0 ≤ 3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret github.com: https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L173-L251 vulncheck.com: https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints

Credits

hieuPenguinnn