VulnSocial

CVE-2026-111642

LOWCVSS 8.7 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • DFIR Lab@DFIR_Lab

    🚨 HIGH SEVERITY: CVE-2026-111642 (CVSS 8.8) FastapiAdmin ≤3.0 contains hard-coded JWT secret allowing privilege escalation to superuser. Attackers can register, login & forge tokens. Patch immediately! #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/sWXG8v8DnV

    0000022
    153 followersView on X

Explore more

Back to dashboard