PT-2026-59658

Summary When parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the...

PT-2026-59399

Summary An internal-only bypass filter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated user to append ?bypass filter=true and bypass model access control checks to invoke admin-restricted models...

PT-2026-59662

Summary parse options header parsed Content-Disposition and Content-Type headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax filename=charset'lang'value, name=..., and the filename0/filename1 continuation form is decoded and surfac...

asphalt-mailer (>=3.0.0, <=3.0.4), async-notify (>=0.6.1, <=0.7.0) +24 more potentially affected by CVE-2026-53533 via aiosmtplib (1.1.7)

aiosmtplib PYPI version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - asphalt-mailer =3.0.0, =0.6.1, =19.7.0, =0.4.0.4, =0.0.1, =0.9.27, =0.0.1, =2.3.0, =2.3.9 - own-comments 0.1.0a4 and more Source cves:...

asphalt-mailer (4.0.0), async-sender (2.0.1) +13 more potentially affected by CVE-2026-53533 via aiosmtplib (2.0.2)

aiosmtplib PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - asphalt-mailer 4.0.0 - async-sender 2.0.1 - axdocsystem =0.1.24, =1.2.3, =0.9.0b19, =0.0.1, =0.1.3, =2.1.5, =2.2.1, =0.1.0, =0.1.5, =0.1.0,...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-23968 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-23968 Source advisory: OSV:PYSEC-2026-1274...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-23986 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-23986 Source advisory: OSV:PYSEC-2026-1272...

dataset-image-annotator (0.0.19), fastapi-auth-service (>=0.0.3, <=0.0.7) potentially affected by CVE-2025-68481 via fastapi-users (10.2.1)

fastapi-users PYPI version 10.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - dataset-image-annotator 0.0.19 - fastapi-auth-service =0.0.3, =0.0.7 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.24.0, <=0.24.7) potentially affected by CVE-2025-68481 via fastapi-users (10.4.1)

fastapi-users PYPI version 10.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.0, =0.24.7 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.22.1, <=0.23.2) potentially affected by CVE-2025-68481 via fastapi-users (10.4.0)

fastapi-users PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.22.1, =0.23.2 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

DescriptionThe OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)

fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: OSV:PYSEC-2026-1362...

cognee (>=0.1.23, <=0.1.36) potentially affected by CVE-2025-68481 via fastapi-users (14.0.0)

fastapi-users PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.23, =0.1.36 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

PYSEC-2026-1362 FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

fastapi-users-db-opensearch (>=0.0.0, <=0.0.4), fastapi-users-db-sqlalchemy (3.0.2) potentially affected by CVE-2025-68481 via fastapi-users (9.3.2)

fastapi-users PYPI version 9.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-db-opensearch =0.0.0, =0.0.4 - fastapi-users-db-sqlalchemy 3.0.2 Source cves: CVE-2025-68481 Source advisory:...

FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

pandahub (0.2.3) potentially affected by CVE-2025-68481 via fastapi-users (9.2.4)

fastapi-users PYPI version 9.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - pandahub 0.2.3 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

PYSEC-2026-1363 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...