FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens… (CVE-2026-111642)

FastapiAdmin up to version 3.0 has a hard-coded JWT signing secret embedded in backend/app/config/setting.py. This secret enables attackers with low privileges to forge HS256 JWT tokens. By registering through the unauthenticated user registration endpoint and logging in, an attacker can create a token that impersonates the superuser by modifying the user_name claim while keeping their session_id. This leads to unauthorized privilege escalation to superuser level.

Successful exploitation allows an attacker with low privileges to escalate their privileges to superuser by forging JWT tokens. This results in full confidentiality, integrity, and availability impact on the affected system, as indicated by the CVSS score of 8.8 with high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the registration endpoint if possible and monitor for suspicious token usage. Avoid using hard-coded secrets and rotate JWT signing keys if feasible.