CRITICAL 9.3 NVD
CVE-2026-111641
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprot
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
References
- https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/au
- https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-
- https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-au
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-16 via NVD.
Risk Timeline
CVE Disclosed2026-10-16 · -1 days ago
Remediation Resources
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.