FastapiAdmin: Authentication bypass via unprotected auto-login endpoints
Summary
FastapiAdmin through version 3.0 exposes auto-login routes under /api/v1/auth/auto-login without any authentication check. An unauthenticated remote attacker can list enabled users, create a login token for any user including the superuser, and exchange it for a valid JWT session with full administrative control. The default configuration is affected, and the attack requires only network access to the application.
Affected
- FastapiAdmin versions 0 to 3.0 (vendor pinned commit 362f005924700157b390b1224142b3cfa276f426 for v3.0)
- Default configuration
Fixed in
Unknown.
Workaround
- Restrict access to the admin backend to a VPN or an IP allow-list.
- Block /api/v1/auth/auto-login/ at the reverse proxy if patching is not possible.
- Review logs for requests to the auto-login routes and for unexpected superuser sessions.
Exploitation
- No confirmed in-the-wild exploitation found.
- Public technical write-ups exist; the exploit steps are described in the linked sources.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Check whether FastapiAdmin 3.0 or earlier is deployed, especially internet-reachable instances.
- Remove public exposure of the admin panel or restrict it to trusted networks now.
- Apply the vendor fix once available; no fixed version has been identified yet.
- Rotate the JWT signing secret and all administrator credentials, and check for signs of compromise if the instance was exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- HackMD write-up (technical analysis) hackmd.io
- Vulnerable source code at v3.0 github.com
- VulDB entry vuldb.com
- CVE-2026-111641 aggregator entry cve.threatint.com
- FastapiAdmin project github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:27.
Original description (NVD)
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
NVD references (3)
- https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L1…
- https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret
- https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.