Hard-Coded JWT Secret in FastapiAdmin 3.0 Allows Superuser Impersonation

FastapiAdmin versions up to 3.0 contain a configuration error that allows low-privileged users to impersonate the superuser. The National Vulnerability Database identifies this as CVE-2026-111642, assigning it a high severity rating of 8.7. The root cause is a hard-coded JSON Web Token signing secret located in the backend application configuration file. This static secret remains unchanged across installations, undermining the cryptographic integrity of session management.

How does the attack work?

The exploit chain begins with the unauthenticated registration endpoint at /api/v1/system/user/register. An attacker creates a standard user account without needing prior credentials. After logging in with these legitimate low-privilege credentials, the attacker obtains a session identifier. Because the JWT signing secret is known and static, the attacker can craft a new HS256 token. This forged token retains the original session identifier but changes the user_name claim to that of the superuser.

What is the impact?

By submitting the forged token, the attacker gains superuser privileges within the FastapiAdmin interface. The system accepts the token as valid because it is signed with the hard-coded secret found in the source code. This allows the attacker to assume the role of the superuser. The National Vulnerability Database categorizes this under CWE-321, which relates to the use of hard-coded credentials.

Which environments are exposed?

The vulnerability affects FastapiAdmin installations running version 3.0 or any earlier release. Organizations using this open-source administration framework for FastAPI applications should verify their current version. If the version is 3.0 or lower, the environment is susceptible to token forgery. The issue is inherent in the default configuration of the backend/app/config/setting.py file, meaning every installation shares the same signing secret unless manually altered.

What comes next?

The source material does not state whether a patch or fix has been released. Users of FastapiAdmin should monitor official channels for updates from the maintainers. Until an update is available, teams must rely on compensating controls to mitigate the risk. This includes restricting access to the administration interface and implementing strict network segmentation. Defenders should also review logs for unusual privilege escalations.

Detection notes

Teams usually monitor for rapid privilege changes that lack corresponding administrative login events. Check whether standard user accounts are performing superuser actions shortly after creation. Look for HTTP requests containing JWT tokens where the user claim differs from the expected role for that session. Verify if the token signature matches known static secrets from public code repositories. Containment moves involve blocking the registration endpoint temporarily and forcing token rotation for all active sessions to invalidate forged credentials.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: FastapiAdmin

• Restrict access to the FastapiAdmin registration endpoint using firewall rules or Web Application Firewall policies to prevent unauthenticated account creation.
• Implement network segmentation to ensure the administration interface is not accessible from the public internet or untrusted networks.
• Monitor application logs for anomalous token usage, specifically looking for session IDs associated with superuser privileges that do not match legitimate admin login patterns.
• Once the vendor provides an update, apply it immediately to replace the hard-coded secret with a unique, randomly generated signing key for each installation.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111642?

The National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.7.

Which versions of FastapiAdmin are affected?

FastapiAdmin versions up to and including 3.0 are affected by this vulnerability.

How do attackers exploit the hard-coded secret?

Attackers register via the unauthenticated endpoint, log in, and forge an HS256 token to impersonate the superuser.