{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/fastapiadmin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fastapiadmin:fastapiadmin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111641"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FastapiAdmin (\u003c= 3.0)"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","authentication-bypass","jwt","webserver"],"_cs_type":"advisory","_cs_vendors":["FastapiAdmin"],"content_html":"\u003cp\u003eFastapiAdmin through version 3.0 is affected by a critical authentication bypass vulnerability (CVE-2026-111641). The vulnerability exists within the application's auto-login functionality, which exposes administrative endpoints without proper authentication requirements. This allows an unauthenticated attacker to interact with the API to enumerate user accounts, generate valid auto-login tokens for arbitrary users, and subsequently exchange these tokens for valid JWT sessions. By targeting accounts with administrative privileges, an attacker can gain full control over the application environment. Given the nature of the vulnerability, which involves direct exploitation of exposed API endpoints, it poses a significant risk to the integrity and confidentiality of any deployment running version 3.0 or earlier. Organizations using FastapiAdmin should audit their API access logs for anomalous requests to the identified auto-login endpoints and restrict access to these paths at the network or reverse proxy level until a patch is applied.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker full administrative access to the FastapiAdmin instance. This allows for the manipulation of application data, unauthorized access to underlying system configurations if the instance is improperly sandboxed, and potential exfiltration of sensitive information managed by the platform. The impact is critical, as it provides a trivial path to total application compromise without prior knowledge of credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the path /api/v1/auth/auto-login/ at the reverse proxy or web application firewall level for all untrusted users.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for requests directed to /api/v1/auth/auto-login/users to identify potential scanning or exploitation attempts.\u003c/li\u003e\n\u003cli\u003eUpgrade to a version of FastapiAdmin that mitigates CVE-2026-111641 as soon as a fix is released by the maintainers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:47:48Z","date_published":"2026-10-16T18:44:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fastapiadmin-auth-bypass/","summary":"FastapiAdmin versions through 3.0 contain an authentication bypass vulnerability allowing unauthenticated attackers to obtain superuser sessions via unprotected auto-login endpoints.","title":"Authentication Bypass in FastapiAdmin","url":"https://feed.craftedsignal.io/briefs/2026-10-fastapiadmin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - FastapiAdmin","version":"https://jsonfeed.org/version/1.1"}