CVE-2026-111641CWE-306

CVE-2026-111641

Critical · published October 16, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-16T22:17Z
References (3)
https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L173-L251 · [email protected]https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret · [email protected]https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints · [email protected]
EPSS history
Timeline
  • 18 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 16 OCT 17:39Z
    FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
    cvelistv5
  • 16 OCT 17:39Z
    FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
    cvelistv5