Is CVE-2026-111641 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111641?

CVE-2026-111641 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-111641

Description

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.