Is CVE-2026-111642 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111642?

CVE-2026-111642 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-111642

Description

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.