CVE-2026-111641: FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the affected FastapiAdmin API endpoints can exploit it. No valid account, prior privileges, or user interaction is required.
What access can an attacker obtain?
An attacker can enumerate users, mint an auto-login token for a superuser, and exchange it for a JWT session. This can result in full administrative control, including high-impact confidentiality, integrity, and availability consequences.
Which endpoints are involved in exploitation?
The user-listing step uses /api/v1/auth/auto-login/users. The vulnerability description also identifies unprotected auto-login endpoints that allow token minting and JWT session exchange, but does not provide the exact paths for those operations.
Are deployments affected by default?
The available information identifies unprotected auto-login endpoints in FastapiAdmin through version 3.0, but does not state whether those endpoints are enabled or exposed in every default deployment.