{"id":"CVE-2026-111642","kind":"vulnerability","aliases":["CVE-2026-111642"],"related":[],"title":"FastAPI-Admin: hard-coded JWT secret lets registered users become superuser","description":"FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.","summary":"FastAPI-Admin through 3.0 signs its JWT tokens with a secret hard-coded in backend/app/config/setting.py. Anyone who registers through the open /api/v1/system/user/register endpoint can forge a token that names the superuser and gain superuser access.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fastapi-admin","package","python","self-hosted"],"not_affected_if":["custom-jwt-secret-set","registration-disabled"],"how_to_check":"grep -n -i 'secret' backend/app/config/setting.py in the FastAPI-Admin install\nIf the JWT secret is a fixed literal in that file rather than read from an environment variable, the install is affected","fix":"Until a fix is confirmed, change the JWT secret to a long random value, restrict or disable public registration, and rotate existing sessions","status":"open","published_at":"2026-10-16T18:17:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:33:26+00:00","updated_at":"2026-10-23T22:33:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources do not name a fixed version\nUntil a fix is confirmed, change the JWT secret to a long random value, restrict or disable public registration, and rotate existing sessions","reach":"internet","title":"FastAPI-Admin: hard-coded JWT secret lets registered users become superuser","impact":"high","summary":"FastAPI-Admin through 3.0 signs its JWT tokens with a secret hard-coded in backend/app/config/setting.py. Anyone who registers through the open /api/v1/system/user/register endpoint can forge a token that names the superuser and gain superuser access.","category":"package","who_cares":["fastapi-admin","python","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Registered attacker forges superuser token and takes full admin control.","analyst_note":"Find the fixed release and whether register is on by default: check the NVD entry CVE-2026-111642 and the FastAPI-Admin GitHub repository and releases.","how_to_check":"grep -n -i 'secret' backend/app/config/setting.py in the FastAPI-Admin install\nIf the JWT secret is a fixed literal in that file rather than read from an environment variable, the install is affected\nunknown whether the register endpoint is enabled by default","needs_analyst":true,"not_affected_if":["custom-jwt-secret-set","registration-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001011,"input_tokens":2953,"output_tokens":1432,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111642':16A,19A '-2026':15A,18A '/api/v1/system/user/register':51B,96C '3.0':32B,67C 'access':64B 'admin':3A,22B,30B 'allow':79C 'anyon':45B 'attack':90C 'backend/app/config/setting.py':44B,77C 'becom':12A 'code':6A,42B,72C 'contain':68C 'cve':14A,17A 'endpoint':52B,97C 'fastapi':2A,21B,29B 'fastapi-admin':1A,20B,28B 'fastapiadmin':65C 'forg':54B,85C,101C 'gain':62B,117C 'hard':5A,41B,71C 'hard-cod':4A,40B,70C 'host':27B 'hs256':103C 'id':108C 'imperson':87C 'jwt':7A,35B,73C 'keep':105C 'let':9A 'log':98C 'low':81C 'low-privileg':80C 'name':58B,110C,115C 'open':50B 'packag':23B 'privileg':82C,119C 'python':24B 'regist':10A,47B,92C 'secret':8A,39B,75C 'self':26B 'self-host':25B 'session':107C 'sign':33B,74C 'superus':13A,60B,63B,89C,112C,118C 'token':36B,56B,86C,104C 'unauthent':95C 'user':11A,83C,114C 'via':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111642","severity":null,"published_at":"2026-10-16T18:17:44+00:00","modified_at":"2026-10-16T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}