CVE-2026-111642Published
FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111642 · Microsoft / collected KEV context
cve-program · CVE-2026-111642
- https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret
- https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/config/setting.py#L67
- https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/core/dependencies.py#L72-L112
- https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-hard-coded-jwt-secret-privilege-escalation
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.