fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-26198 via ormar (>=0.10.16, <=0.20.2)

ormar PYPI version =0.10.16, =0.0.1, =0.3.1, =0.3.0, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-26198 Source advisory: GHSA-XXH2-68G9-8JQR...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-26198 via ormar (>=0.10.16, <=0.20.2)

ormar PYPI version =0.10.16, =0.0.1, =0.3.1, =0.3.0, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-26198 Source advisory: OSV:GHSA-XXH2-68G9-8JQR...

Cross-Site Request Forgery (CSRF)

fastapiusers is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to stateless and predictable OAuth state tokens with no session binding or per-request entropy, which allows an attacker to initiate an OAuth flow, reuse a valid state token, and trick a victim into completing...

CVE-2025-68481

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

CVE-2025-68481

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

GHSA-5J53-63W8-8625 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

cognee (>=0.1.37, <=0.2.1.dev0), langchain-cognee (0.1.0) potentially affected by CVE-2025-68481 via fastapi-users (14.0.1)

fastapi-users PYPI version 14.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.37, =0.2.1.dev0 - langchain-cognee 0.1.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

pandahub (0.2.3) potentially affected by CVE-2025-68481 via fastapi-users (9.2.4)

fastapi-users PYPI version 9.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - pandahub 0.2.3 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fastapi-users-db-opensearch (>=0.0.0, <=0.0.4), fastapi-users-db-sqlalchemy (3.0.2) potentially affected by CVE-2025-68481 via fastapi-users (9.3.2)

fastapi-users PYPI version 9.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-db-opensearch =0.0.0, =0.0.4 - fastapi-users-db-sqlalchemy 3.0.2 Source cves: CVE-2025-68481 Source advisory:...

fief-server (>=0.24.0, <=0.24.7) potentially affected by CVE-2025-68481 via fastapi-users (10.4.1)

fastapi-users PYPI version 10.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.0, =0.24.7 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

balify (0.0.2), cognee (>=0.2.1.dev1, <=0.5.2) +35 more potentially affected by CVE-2025-68481 via fastapi-users (14.0.2)

fastapi-users PYPI version 14.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - balify 0.0.2 - cognee =0.2.1.dev1, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 -...

dataset-image-annotator (0.0.19), fastapi-auth-service (>=0.0.3, <=0.0.7) potentially affected by CVE-2025-68481 via fastapi-users (10.2.1)

fastapi-users PYPI version 10.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - dataset-image-annotator 0.0.19 - fastapi-auth-service =0.0.3, =0.0.7 Source cves: CVE-2025-68481 Source advisory:...

fief-server (>=0.22.1, <=0.23.2) potentially affected by CVE-2025-68481 via fastapi-users (10.4.0)

fastapi-users PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.22.1, =0.23.2 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

cognee (>=0.1.23, <=0.1.36) potentially affected by CVE-2025-68481 via fastapi-users (14.0.0)

fastapi-users PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.23, =0.1.36 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

Cross-site Request Forgery (CSRF)

Overview fastapi-users is a Ready-to-use and customizable users management for FastAPI Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the generatestatetoken function, which is called with an empty statedata dict, so the resulting JWT contains only the fixe...

CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...