CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

EUVD-2025-204614

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

balify (0.0.2), cognee (>=0.1.23, <=0.5.2) +49 more potentially affected by CVE-2025-68481 via fastapi-users (>=9.2.4, <=14.0.2)

fastapi-users PYPI version =9.2.4, =0.1.23, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 - cognee-community-vector-adapter-redis 0.1.0 - cognee-community-vector-adapter-valkey 0.1.1 and more Source cves: CVE-2025-68481 Source advisory: MEND:CVE-2025-68481...

CVE-2025-68481

CVE-2025-68481 affects FastAPI Users. Before 15.0.2, OAuth state tokens are generated with an empty state_data, making the JWT contain only a fixed audience and expiry. The callback checks the state JWT but does not tie it to the user session, lacks a correlation cookie or server-side cache, and ...

CVE-2025-68481: Improper Authorization

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

PT-2025-52515

Name of the Vulnerable Software and Affected Versions FastAPI Users versions prior to 15.0.2 Description FastAPI Users is a system designed to add registration and authentication to FastAPI projects. A login Cross-Site Request Forgery CSRF exists because OAuth login state tokens are stateless and...

FastAPI Users: Cross-Site Request Forgery Vulnerability

FastAPI Users is a customizable user management interface from FastAPI Users open source. A cross-site request forgery vulnerability exists in FastAPI Users versions prior to 15.0.2, which stems from stateless OAuth login status tokens and missing correlation data, which could lead to login CSRF...