How do I check whether I am affected by CVE-2026-111641?

Look in backend/app/api/v1/module_system/auth/controller.py for /auto-login routes without an auth dependency (GET /api/v1/auth/auto-login/users, POST /api/v1/auth/auto-login/token, POST /api/v1/auth/auto-login). In a test environment you own, check whether the routes answer without a login. Also check that SECRET_KEY is set in your deployment env and is not the default from app/config/setting.py.

What is the fix for CVE-2026-111641?

No patched version confirmed. Mitigate: block /api/v1/auth/auto-login* at the reverse proxy or restrict to trusted IPs, add authorization to those routes, set a strong unique SECRET_KEY and rotate it (invalidates issued JWTs), review admin accounts and sessions. Check the project's releases for anything after 3.0 (a V3.1.0 label exists, unverified).

Who is not affected by CVE-2026-111641?

Not affected if: auto-login-routes-blocked, fastapiadmin-newer-than-3.0, internal-only.

Live › vulnerability › CVE-2026-111641

Go to dashboard

critical9.8Package

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

FastapiAdmin <= 3.0 exposes three auto-login routes with no auth dependency, in the default config. An unauthenticated attacker lists users, mints a superuser auto-login token and exchanges it for a JWT: full admin takeover. The researcher also reports a hard-coded default JWT SECRET_KEY in app/config/setting.py (separate issue). No vendor fix or advisory is known; the report was static review only, with no public PoC.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Unauthenticated attacker gains superuser admin control over the application.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-111641

Go to dashboard

critical9.8Package

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Unauthenticated attacker gains superuser admin control over the application.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources