CVE-2026-111641

Summary

FastapiAdmin contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full administrative access by exploiting unprotected auto-login endpoints. This flaw enables attackers to impersonate any user and obtain JWT sessions with superuser privileges.

Exploitability

The vulnerability is highly exploitable with no prerequisites, requiring only network access to the application's API endpoints to enumerate users and mint superuser tokens.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise administrative access to FastapiAdmin installations, potentially leading to complete system takeover and data exfiltration across all user accounts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FastapiAdmin version 3.1 or later to address the authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.