---
id: "CVE-2026-111641"
kind: "vulnerability"
aliases: ["CVE-2026-111641"]
title: "FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "FastapiAdmin", "fixed": [], "affected": "<= 3.0", "ecosystem": "pip"}]
ecosystems: []
tags: ["auth-bypass", "fastapi", "fastapiadmin", "package", "self-hosted"]
not_affected_if: ["auto-login-routes-blocked", "fastapiadmin-newer-than-3.0", "internal-only"]
published_at: "2026-10-16T18:17:44+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:31:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111641", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:31:11+00:00"}]
---

# FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

FastapiAdmin <= 3.0 exposes three auto-login routes with no auth dependency, in the default config. An unauthenticated attacker lists users, mints a superuser auto-login token and exchanges it for a JWT: full admin takeover. The researcher also reports a hard-coded default JWT SECRET_KEY in app/config/setting.py (separate issue). No vendor fix or advisory is known; the report was static review only, with no public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:FastapiAdmin affected <= 3.0 fixed ?

## How to check

Look in backend/app/api/v1/module_system/auth/controller.py for /auto-login routes without an auth dependency (GET /api/v1/auth/auto-login/users, POST /api/v1/auth/auto-login/token, POST /api/v1/auth/auto-login). In a test environment you own, check whether the routes answer without a login. Also check that SECRET_KEY is set in your deployment env and is not the default from app/config/setting.py.

## Fix

No patched version confirmed. Mitigate: block /api/v1/auth/auto-login* at the reverse proxy or restrict to trusted IPs, add authorization to those routes, set a strong unique SECRET_KEY and rotate it (invalidates issued JWTs), review admin accounts and sessions. Check the project's releases for anything after 3.0 (a V3.1.0 label exists, unverified).

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111641
- 2026-10-23T23:31:11+00:00 analyst — Read researcher write-up (hackmd) and VulnCheck advisory: no patched version named, no vendor advisory/GHSA; auto-login routes unauthenticated by default in v3.0 (static review only, no PoC, not exploited per sources). GitHub releases page shows V3.1.0 but tagged v3.0, unverified whether it fixes this.

## Documents

- [advisory] FastapiAdmin unauthenticated autologin and hardcoded JWT secret (researcher write-up) https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret
- [advisory] VulnCheck: fastapiadmin through 3.0 auth bypass via auto-login endpoints https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints

## From the sources

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_