CVE-2026-111641

LOWCVSS 9.3 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

DFIR Lab@DFIR_Lab23h
🚨 CRITICAL: CVE-2026-111641 (CVSS 9.8) FastapiAdmin ≤3.0 auth bypass allows unauthenticated attackers to gain superuser access via unprotected auto-login endpoints. Immediate patching required. #CVE #Vulnerability #PatchNow #ThreatIntel #CyberSecurity https://t.co/VhOelWjlN0
0000030
153 followersView on X

Explore more

Back to dashboard