The flaw originates from a hard‑coded JWT signing secret located in the backend configuration. Because the secret is fixed, an attacker can generate an HS256 signed token that claims to be the superuser. By registering via the unauthenticated /api/v1/system/user/register endpoint, logging in, and substituting the user_name field with the superuser value while preserving the session_id, a lower‑privileged user can effectively impersonate an administrator. This grants full control over the application, exposing confidentiality, integrity, and availability of all data and functions. The vulnerability stems from CWE-321: Use of Hard‑coded Cryptographic Key.

FastapiAdmin, version 3.0 and earlier. The vulnerability is present in all releases through v3.0 of the FastapiAdmin package. Administrators deploying these versions should verify their installed package.

The CVSS score of 8.7 reflects a high impact and high exploitability, and the absence of an EPSS score indicates that no public exploitation data is available yet. The vulnerability can be triggered from any network host that can reach the API endpoints, which means the attack vector is network accessible. Because the flaw requires only the ability to submit an HTTP request and no specific user privileges, the likelihood of exploitation remains significant until the secret is changed or the application is updated. The vulnerability is not currently listed in the CISA KEV catalog, but its high CVSS rating and the ease of token forgery make it a serious risk.