The flaw lies in unprotected auto‑login endpoints that let anyone without credentials trigger a login flow for any user; the attacker can harvest a superuser token and convert it into a JWT session. The result is a complete hijacking of the application with all administrative privileges. This is a classic authentication bypass vulnerability (CWE‑306) with the highest potential impact when exploited.

FastapiAdmin by FastapiAdmin, version 3.0. No further granular version information is supplied, but the issue exists in all releases up to and including that major version.

The CVSS score of 9.3 signals critical severity, and the lack of an EPSS entry indicates that exploitation probability data is not publicly available. The vulnerability is not yet listed in the CISA KEV catalog. Attackers could exploit the flaw by sending simple HTTP requests to /api/v1/auth/auto-login endpoints; once the token is minted, the attacker can obtain an active session token and gain full control.