EUVD-2026-103063
GHSA-xj6f-6mc4-xhqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed FastapiAdmin API
-
DeliveryEnumerate users via auto-login endpoint
-
ExploitMint superuser auto-login token
-
ExecutionExchange token for JWT session
-
ImpactGain full administrative control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default deployments of FastapiAdmin through 3.0, where the /api/v1/auth/auto-login/users and auto-login token endpoints are present and network-reachable by design. The only real limiting factor is network exposure of the admin API: an instance bound to localhost or placed behind an authenticating reverse proxy / network ACL is not reachable. No user interaction, no authentication, and no non-default configuration are required to trigger the bypass; the compounding hardcoded JWT secret (noted in the referenced writeup) further undermines any token-based defense. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the CWE-306 (Missing Authentication for Critical Function) root cause is corroborated by the description, which names the exact unprotected endpoints and a working abuse chain. All three impact metrics are High (VC:H/VI:H/VA:H), consistent with full administrative takeover. The VulnCheck advisory plus a detailed public hackmd writeup documenting the full exploitation path (and an accompanying hardcoded-JWT-secret weakness) mean the barrier to exploitation is effectively published knowledge rather than theory. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified, and the CVE is NOT on the CISA KEV list, so there is no confirmation of active in-the-wild exploitation - the risk here is driven by trivial exploitability and public technical detail, not by observed attacks. The main mitigating factor is deployment footprint: FastapiAdmin is a niche open-source admin framework, so the population of exposed, internet-reachable instances is likely small compared with mainstream enterprise software. |
| Exploit ScenarioDerived | An attacker who can reach a FastapiAdmin (≤3.0) instance over the network calls /api/v1/auth/auto-login/users to enumerate accounts, mints an auto-login token for a superuser, and exchanges it for a valid JWT session - all without any credentials. Given AV:N/AC:L/PR:N/UI:N, this is a single-request-chain remote takeover against a default deployment, and a public writeup already details the exact steps, so no original research is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated attackers can obtain a valid JWT session for any account - including superusers - in FastapiAdmin through 3.0 by abusing auto-login endpoints that ship without authentication checks. The attack chain is straightforward: enumerate accounts via /api/v1/auth/auto-login/users, mint a superuser auto-login token, then exchange that token for a full JWT session granting complete administrative control of the application. Exploitation requires only network reachability to the admin API with no credentials, no user interaction, and no non-default configuration, and the referenced public writeup also notes a hardcoded JWT signing secret that further undercuts token-based defenses; no vendor-released patch was identified at time of analysis, and no public exploit code was confirmed.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must rely on blocking or removing the vulnerable attack path. The most direct control is to deny all requests to /api/v1/auth/auto-login/* (and specifically /api/v1/auth/auto-login/users and the token-minting route) at the reverse proxy, API gateway, or WAF, then verify the endpoints are unreachable from untrusted networks - the trade-off is that any legitimate auto-login provisioning workflow that depends on those routes will stop functioning, so confirm they are unused before blocking. If the auto-login router is not required at all, remove or comment out its registration in the FastAPI application so the routes are not mounted, which eliminates the flaw at the source but requires modifying and redeploying the application. As defense in depth, restrict the entire admin API to a trusted network segment or VPN and avoid exposing it to the internet, since the assessment confirms the only meaningful limiting factor is network reachability. Because the referenced writeup identifies a hardcoded JWT secret, rotate and externalize that signing key into environment-specific configuration, and invalidate all existing sessions and tokens on rotation - note this does not fix the unauthenticated token-minting path on its own, but it does close the independent token-forgery vector. Immediately audit logs and the user/session tables for evidence of enumeration of /api/v1/auth/auto-login/users or unexpected superuser JWT issuance, and review emergency revocation tooling. Track the VulnCheck advisory (https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints) and the upstream repository for a fixed release, and upgrade as soon as an official patched version is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FastapiAdmin is a Python-based administrative backend framework built on FastAPI, using JWT bearer tokens for session management and versioned REST routes such as /api/v1/auth/. The flaw is CWE-306 (Missing Authentication for Critical Function): the auto-login controller exposed at backend/app/api/v1/module_system/auth/controller.py (lines ~173-251) implements user enumeration and token-minting endpoints that are reachable without any authentication or authorization gate, effectively treating 'auto-login' as a trusted internal helper rather than a privileged operation. Because the minted auto-login token is exchanged for a standard JWT session, the defect collapses the entire authentication boundary - the JWT layer cannot compensate when the token issuance path itself is unauthenticated. The CPE cpe:2.3:a:fastapiadmin:fastapiadmin:*:*:*:*:*:*:*:* indicates the advisory covers the FastapiAdmin product line through version 3.0, and the linked GitHub source at tag v3.0 shows the vulnerable code in place. The accompanying public writeup additionally documents a hardcoded JWT secret, which means tokens may be forgeable independently of the auto-login path - an issue that undermines rotation-based mitigations unless the secret itself is changed.
Know when Fastapiadmin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unprotected network endpoints need no auth or interaction (PR:N/UI:N/AC:L/AV:N); superuser session grants full read/write/destroy control, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
Executive ViewAI
FastapiAdmin 3.0 and earlier exposes auto-login API endpoints that can hand an attacker a full administrative session, creating a credible path to complete takeover of any deployment running the platform. The attack requires only network reachability to the admin API - no credentials, no user interaction, and no non-default configuration - and a hardcoded JWT signing secret further weakens the token defenses that would normally limit the blast radius. Leadership should treat this as an enterprise-wide application compromise risk affecting every account, record, and administrative function managed through FastapiAdmin, with no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: block or disable the /api/v1/auth/auto-login/* endpoints at the reverse proxy, WAF, or network layer; restrict admin API reachability to trusted management networks; rotate the hardcoded JWT signing secret to a unique high-entropy value and invalidate existing sessions; disable the auto-login feature entirely where it is not required; and monitor and alert on auto-login endpoint access and unexpected JWT issuance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fastapiadmin
View allFastApiAdmin versions up to 2.2.0 expose sensitive information through the reset_api_docs function in the Custom Documen
Privilege escalation in FastapiAdmin through version 3.0 allows any remote attacker who can reach the API to self-regist
FastApiAdmin up to 2.2.0 contains an unrestricted file upload vulnerability in the user avatar upload endpoint that allo
Unrestricted file upload in FastApiAdmin up to version 2.2.0 allows authenticated remote attackers to upload arbitrary f
FastApiAdmin versions up to 2.2.0 contain an unrestricted file upload vulnerability in the Scheduled Task API's upload c
FastApiAdmin versions up to 2.2.0 contain an information disclosure vulnerability in the file download endpoint that all
Exploit-DB