Live › vulnerability › CVE-2026-111642
Go to dashboardFastAPI-Admin through 3.0 signs its JWT tokens with a secret hard-coded in backend/app/config/setting.py. Anyone who registers through the open /api/v1/system/user/register endpoint can forge a token that names the superuser and gain superuser access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
grep -n -i secret backend/app/config/setting.py in the FastAPI-Admin install
If the JWT secret is a fixed literal in that file rather than read from an environment variable, the install is affected
Until a fix is confirmed, change the JWT secret to a long random value, restrict or disable public registration, and rotate existing sessions
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-111642")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.