{"metadata": {"vulnerability": "CVE-2026-111641", "count": 19, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111641", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:31:13.594Z", "date_only": false, "value": "2026-10-16T14:31:13.594Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111641", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:11.674Z", "date_only": false, "value": "2026-10-16T17:39:11.674Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111641", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:39:11.674Z", "date_only": false, "value": "2026-10-16T17:39:11.674Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111641", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:14:00.992Z", "date_only": false, "value": "2026-10-16T18:14:00.992572Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117451944135697734", "record": "CVE-2026-111641", "field": "creation_timestamp", "uuid": "fd5b9472-ce82-4fb9-944a-53e909f29525", "content": "CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111641https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secrethttps://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L173-L251https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints#fastapiadmin #FastapiAdmin#CVE_2026_111641#bot", "url": "https://infosec.exchange/users/cve/statuses/117451944135697734"}, {"timestamp": "2026-10-16T18:17:44Z", "date_only": false, "value": "2026-10-16T18:17:44Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XJ6F-6MC4-XHQP", "record": "GHSA-XJ6F-6MC4-XHQP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:44.730Z", "date_only": false, "value": "2026-10-16T18:17:44.730", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111641", "record": "FKIE_CVE-2026-111641", "field": "published"}, {"timestamp": "2026-10-16T18:34:46Z", "date_only": false, "value": "2026-10-16T18:34:46Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XJ6F-6MC4-XHQP", "record": "GHSA-XJ6F-6MC4-XHQP", "field": "published"}, {"timestamp": "2026-10-16T18:34:46Z", "date_only": false, "value": "2026-10-16T18:34:46Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XJ6F-6MC4-XHQP", "record": "GHSA-XJ6F-6MC4-XHQP", "field": "modified"}, {"timestamp": "2026-10-16T20:08:35.642Z", "date_only": false, "value": "2026-10-16T20:08:35.642385Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzexej2mb2r", "record": "CVE-2026-111641", "field": "creation_timestamp", "uuid": "5e3007f5-c977-47b1-8f9c-89da1482d0d5", "content": "\ud83d\udea8 CVE-2026-111641 \u2014 CVSS 9.3 CRITICAL\n\nFastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attack...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111641\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzexej2mb2r"}, {"timestamp": "2026-10-16T20:30:05.771Z", "date_only": false, "value": "2026-10-16T20:30:05.771305Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzg5svie424", "record": "CVE-2026-111641", "field": "creation_timestamp", "uuid": "66ee33ce-3211-4f99-8894-8fcc0ada2fa7", "content": "CVE-2026-111641 - fastapiadmin\nThe FastapiAdmin web\u2011admin tool (versions up to 3.0) includes login endpoints that anyone can call without proving their identity. An attacker can use these endpoints to create a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#fastapiadmin #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzg5svie424"}, {"timestamp": "2026-10-16T20:53:27.012Z", "date_only": false, "value": "2026-10-16T20:53:27.012767Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111641", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T20:53:27.012Z", "date_only": false, "value": "2026-10-16T20:53:27.012767Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111641", "record": "FKIE_CVE-2026-111641", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T21:18:51.468Z", "date_only": false, "value": "2026-10-16T21:18:51.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111641", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:18:51.468Z", "date_only": false, "value": "2026-10-16T21:18:51.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111641", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T22:17:21.500Z", "date_only": false, "value": "2026-10-16T22:17:21.500", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111641", "record": "FKIE_CVE-2026-111641", "field": "lastModified"}, {"timestamp": "2026-10-17T10:30:26.402Z", "date_only": false, "value": "2026-10-17T10:30:26.402707Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117455783545921457", "record": "CVE-2026-111641", "field": "creation_timestamp", "uuid": "647e7c3b-eb74-4fed-b266-04f813ca4377", "content": "CVE-2026-111641: FastapiAdmin <=3.0 has a CRITICAL auth bypass flaw \u2014 unauthenticated attackers can seize admin sessions via exposed endpoints. Restrict access & watch for abuse until a patch lands. Details: https://radar.offseq.com/threat/fastapiadmin-through-30-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-8a2c1a85a7cb4068 #OffSeq #CVE2026111641 #infosec #security", "url": "https://infosec.exchange/users/offseq/statuses/117455783545921457"}, {"timestamp": "2026-10-17T10:30:28.006Z", "date_only": false, "value": "2026-10-17T10:30:28.006266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3my2v4il5ad2j", "record": "CVE-2026-111641", "field": "creation_timestamp", "uuid": "be2f2608-a563-46cf-86ca-5617c6170909", "content": "FastapiAdmin through 3.0 is exposed to a CRITICAL auth bypass (CVE-2026-111641) \u2014 attackers can gain admin access via auto-login endpoints. Restrict access & monitor for unauthorized activity. https://radar.offseq.com/threat/fastapiadmin-through-30-contains-an-authentication-bypass-vulnerability-...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3my2v4il5ad2j"}, {"timestamp": "2026-10-17T15:30:04.732Z", "date_only": false, "value": "2026-10-17T15:30:04.732119Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fishwalkerit.bsky.social/post/3my3fuaebpi22", "record": "CVE-2026-111641", "field": "creation_timestamp", "uuid": "354d38f7-5770-4c17-9e3d-0680cf6d4853", "content": "L\u1ed7 h\u1ed5ng CVSS 9.8 trong FastapiAdmin: chi\u1ebfm quy\u1ec1n admin m\u00e0 kh\u00f4ng c\u1ea7n bi\u1ebft m\u1eadt kh\u1ea9u (CVE-2026-111641)\n\nL\u1ed7 h\u1ed5ng CVE-2026-111641 trong FastapiAdmin, \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 ng\u00e0y 16/10/2026, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ch\u01b0a \u0111\u0103ng nh\u1eadp chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n t\u00e0i kho\u1ea3n b\u1ea5t k\u1ef3 \u2014 k\u1ec3 c\u1ea3 t\u00e0i kho\u1ea3n superuser \u2014 th\u00f4ng qua ba\u2026", "url": "https://bsky.app/profile/fishwalkerit.bsky.social/post/3my3fuaebpi22"}]}