CVE-2026-111642: FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their sessionid but naming the superuser in username to gain superuser privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged user who can register through the unauthenticated /api/v1/system/user/register endpoint and then log in can exploit it. No user interaction is required.
What does an attacker need to do to obtain superuser privileges?
The attacker registers an account, logs in to obtain a session_id, and forges an HS256 JWT using the hard-coded signing secret. The forged token retains that session_id while setting user_name to the superuser's name.
Which versions are affected?
FastapiAdmin versions through 3.0 are affected.