CVE-2026-111641
Received Received - Intake

Authentication Bypass in FastapiAdmin via Auto-Login Endpoints

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111641
EUVD
EUVD-2026-103063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fastapiadmin FastapiAdmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FastapiAdmin through version 3.0 has an authentication bypass flaw. Unauthenticated attackers can exploit unprotected auto-login endpoints to create sessions for any user. By listing users via /api/v1/auth/auto-login/users, minting a superuser auto-login token, and exchanging it for a JWT session, attackers gain full administrative access to the system.

Detection Guidance

Check for unauthenticated access to /api/v1/auth/auto-login/users endpoint. Use curl to test if the endpoint returns a list of users without authentication. Example command: curl -v http://<target>/api/v1/auth/auto-login/users

Impact Analysis

This vulnerability allows attackers to gain complete control over the FastapiAdmin instance. They can access sensitive data, modify configurations, delete users, or perform other malicious actions without detection. The impact includes data breaches, system compromise, and potential lateral movement within connected networks.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data. GDPR mandates strict access controls and breach notification, while HIPAA requires safeguards for protected health information. Exploitation could lead to regulatory fines, legal liabilities, and reputational damage.

Mitigation Strategies

Immediately update FastapiAdmin to the latest version that patches this vulnerability. If an update is not available, restrict access to the /api/v1/auth/auto-login/users endpoint and disable auto-login features until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart