FastapiAdmin: Hard-coded JWT signing secret allows privilege escalation
Summary
FastapiAdmin through version 3.0 ships a hard-coded JWT signing secret in its configuration file. An attacker who can register a regular account through the unauthenticated registration endpoint can forge a token that names the superuser and gain superuser rights. The attack requires network access to the application and a valid low-privileged account, which the registration endpoint provides.
Affected
- FastapiAdmin versions 0 to 3.0 (according to the CNA, VulnCheck)
- Default configuration in backend/app/config/setting.py
Fixed in
Unknown. No fixed version has been published at the time of writing.
Workaround
- Remove the hard-coded secret and load a strong, random key from an environment variable or secrets manager
- Disable or restrict public self-registration
- Place the admin panel behind a VPN or an allow-list
Exploitation
- CISA SSVC lists exploitation as "poc" (proof of concept available); automatable: no
- No confirmed exploitation in the wild found in the sources
Our recommendation
- Check whether FastapiAdmin 3.0 or earlier is running and whether it is reachable from the internet
- Apply the workaround: replace the hard-coded key and restrict registration and admin access
- Expect all existing sessions to become invalid after the key change and plan forced re-logins
- Review user accounts for unexpected new registrations and for superuser logins from unknown IP addresses
- Monitor for further updates from the upstream project and install a fixed version once available
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-111642 osv.dev
- VulDB CVE-2026-111642 vuldb.com
- Vulnerable code: setting.py (v3.0) github.com
- Vulnerable code: dependencies.py (v3.0) github.com
- Researcher write-up (HackMD) hackmd.io
- Strix CVE-2026-111642 www.strix.ai
- FastapiAdmin project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:14.
Original description (NVD)
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
NVD references (5)
- https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/config/setting.py#L67
- https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/core/dependencies.py#L72-L112
- https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret
- https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-hard-coded-jwt-secret-privilege-escalation
- https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.