PYSEC-2026-1363 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

DescriptionThe OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

pandahub (0.2.3) potentially affected by CVE-2025-68481 via fastapi-users (9.2.4)

fastapi-users PYPI version 9.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - pandahub 0.2.3 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.24.0, <=0.24.7) potentially affected by CVE-2025-68481 via fastapi-users (10.4.1)

fastapi-users PYPI version 10.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.0, =0.24.7 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

fastapi-users-db-opensearch (>=0.0.0, <=0.0.4), fastapi-users-db-sqlalchemy (3.0.2) potentially affected by CVE-2025-68481 via fastapi-users (9.3.2)

fastapi-users PYPI version 9.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-db-opensearch =0.0.0, =0.0.4 - fastapi-users-db-sqlalchemy 3.0.2 Source cves: CVE-2025-68481 Source advisory:...

dataset-image-annotator (0.0.19), fastapi-auth-service (>=0.0.3, <=0.0.7) potentially affected by CVE-2025-68481 via fastapi-users (10.2.1)

fastapi-users PYPI version 10.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - dataset-image-annotator 0.0.19 - fastapi-auth-service =0.0.3, =0.0.7 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.22.1, <=0.23.2) potentially affected by CVE-2025-68481 via fastapi-users (10.4.0)

fastapi-users PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.22.1, =0.23.2 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

cognee (>=0.1.23, <=0.1.36) potentially affected by CVE-2025-68481 via fastapi-users (14.0.0)

fastapi-users PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.23, =0.1.36 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

cognee (>=0.1.37, <=0.2.1.dev0), langchain-cognee (0.1.0) potentially affected by CVE-2025-68481 via fastapi-users (14.0.1)

fastapi-users PYPI version 14.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.37, =0.2.1.dev0 - langchain-cognee 0.1.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

balify (0.0.2), cognee (>=0.2.1.dev1, <=0.5.2) +35 more potentially affected by CVE-2025-68481 via fastapi-users (14.0.2)

fastapi-users PYPI version 14.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - balify 0.0.2 - cognee =0.2.1.dev1, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 -...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

async-easy-utils (>=0.0.1, <=0.1.3), busylight-for-humans (>=0.4.0, <=0.4.3) +22 more potentially affected by CVE-2026-48818 via starlette (0.13.4)

starlette PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - async-easy-utils =0.0.1, =0.4.0, =0.1.0, =0.57.0, =2.0.0, =1.0.1, =1.0.0b50, =0.1.0, =0.1.0, =0.1.16, =0.0.1.dev1, =2.0.0a1, =0.1.5, =0.1.7 a...

auditorium (>=19.1.2, <=20.2.1), bbfcapi (>=1.0.0, <=1.0.1) +23 more potentially affected by CVE-2026-48818 via starlette (0.12.9)

starlette PYPI version 0.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - auditorium =19.1.2, =1.0.0, =0.8.0, =0.1.1, =0.0.1, =0.4.0, =0.41.0, =0.1.16, =0.1.29, =0.1.0, =0.0.2, =1.0.0b1, =0.1.1, =0.1.6 and more Sour...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: SNYK:PYTHON-ORMAR-15701843...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: MEND:CVE-2026-27953...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: OSV:GHSA-F964-WHRQ-44H8...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: GHSA-F964-WHRQ-44H8...