Authentication Bypass in FastapiAdmin

FastapiAdmin through version 3.0 is affected by a critical authentication bypass vulnerability (CVE-2026-111641). The vulnerability exists within the application's auto-login functionality, which exposes administrative endpoints without proper authentication requirements. This allows an unauthenticated attacker to interact with the API to enumerate user accounts, generate valid auto-login tokens for arbitrary users, and subsequently exchange these tokens for valid JWT sessions. By targeting accounts with administrative privileges, an attacker can gain full control over the application environment. Given the nature of the vulnerability, which involves direct exploitation of exposed API endpoints, it poses a significant risk to the integrity and confidentiality of any deployment running version 3.0 or earlier. Organizations using FastapiAdmin should audit their API access logs for anomalous requests to the identified auto-login endpoints and restrict access to these paths at the network or reverse proxy level until a patch is applied.

Impact

Successful exploitation grants an attacker full administrative access to the FastapiAdmin instance. This allows for the manipulation of application data, unauthorized access to underlying system configurations if the instance is improperly sandboxed, and potential exfiltration of sensitive information managed by the platform. The impact is critical, as it provides a trivial path to total application compromise without prior knowledge of credentials.

Recommendation

• Restrict access to the path /api/v1/auth/auto-login/ at the reverse proxy or web application firewall level for all untrusted users.
• Audit web server logs for requests directed to /api/v1/auth/auto-login/users to identify potential scanning or exploitation attempts.
• Upgrade to a version of FastapiAdmin that mitigates CVE-2026-111641 as soon as a fix is released by the maintainers.