CVE-2026-111641 — FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login …
Published: 2026-10-16 · CVSS: 9.3 · CVSS 4.0
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7