https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T19:49:19.867683+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111642 CVE-2026-111642 — FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation 2026-10-17T19:49:19.869903+00:00

Affected: FastapiAdmin

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.