CVE-2026-111641

Published: Ott 16, 2026 Last Modified: Ott 17, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL 9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0043
Percentile
0,4th
Updated

EPSS Score Trend (Last 3 Days)

306

Missing Authentication for Critical Function

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Cloud Computing, ICS/OT
Likelihood of Exploit: High
View CWE Details
https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/back…
https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/modul…
https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticat…
https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-har…
https://www.vulncheck.com/advisories/fastapiadmin-through-3…
https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-by…