FastapiAdmin EUVD-2026-103064

Exploitation requires that the FastapiAdmin instance expose the unauthenticated /api/v1/system/user/register endpoint (present by default through v3.0), allowing an attacker to create a low-privileged account and log in for a valid session_id. The attacker then forges an HS256 JWT signed with the hard-coded secret in backend/app/config/setting.py, retaining their session_id while setting user_name to the superuser. Limiting factors: the attacker needs network reachability to the API and the open-registration endpoint must be enabled; no user interaction, no prior credentials, and no administrative access are required, and no non-default configuration is needed on an affected 3.0-or-earlier build.

This is a genuine, high-priority privilege-escalation flaw rather than an inflated-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges - and that bar is effectively trivial because the companion weakness is an unauthenticated self-registration endpoint (/api/v1/system/user/register), so any remote attacker can mint the 'low-privileged' account needed. The hard-coded HS256 secret (CWE-321) then yields full superuser impersonation with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). No EPSS score, CISA KEV listing, or formal POC/exploit flag was supplied in the input, so automated-exploitation probability cannot be quantified from the data; however, the referenced HackMD writeup documents the complete forging technique step by step, materially lowering the barrier to weaponization. SSVC-style reading: exploitation is not confirmed active, technical impact is total, and the attack is plausibly automatable given fixed, publicly known secret material. Note one tension to verify: the input Tags label this 'Information Disclosure,' but the description and CWE-321 describe authentication bypass / privilege escalation, not disclosure - treat the tag as inaccurate.

A remote attacker self-registers a normal account through the open /api/v1/system/user/register endpoint, logs in to obtain a valid session_id, then uses the publicly disclosed hard-coded secret to forge an HS256 JWT that keeps their session_id but sets user_name to the superuser, instantly gaining administrative control. A detailed public technical writeup (HackMD) describes this exact chain, though no packaged exploit tool or active exploitation was indicated in the input. The low attack complexity and network vector make this practical for any attacker who can reach the application's API.