CVE-2026-111642 Details

A vulnerability in FastapiAdmin versions through 3.0 allows low-privileged users to gain superuser privileges by exploiting a hard-coded JWT signing secret. The issue arises from the absence of authentication dependencies in certain auto-login routes, combined with a default secret key that can be used to forge tokens. Attackers can register through the unauthenticated user registration endpoint, log in, and then create a token that impersonates the superuser by manipulating the token's user_name claim.

To address this vulnerability, remove the auto-login routes or add authentication dependencies to them, ensuring that only authorized users can access these functions. Additionally, make the JWT secret key a required environment variable, eliminating the default value that can be exploited.