fastapi-users-db-opensearch (>=0.0.0, <=0.0.4), fastapi-users-db-sqlalchemy (3.0.2) potentially affected by CVE-2025-68481 via fastapi-users (9.3.2)

fastapi-users PYPI version 9.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-db-opensearch =0.0.0, =0.0.4 - fastapi-users-db-sqlalchemy 3.0.2 Source cves: CVE-2025-68481 Source advisory:...

GHSA-5J53-63W8-8625 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

pandahub (0.2.3) potentially affected by CVE-2025-68481 via fastapi-users (9.2.4)

fastapi-users PYPI version 9.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - pandahub 0.2.3 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

cognee (>=0.1.37, <=0.2.1.dev0), langchain-cognee (0.1.0) potentially affected by CVE-2025-68481 via fastapi-users (14.0.1)

fastapi-users PYPI version 14.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.37, =0.2.1.dev0 - langchain-cognee 0.1.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fief-server (>=0.24.0, <=0.24.7) potentially affected by CVE-2025-68481 via fastapi-users (10.4.1)

fastapi-users PYPI version 10.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.0, =0.24.7 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fief-server (>=0.22.1, <=0.23.2) potentially affected by CVE-2025-68481 via fastapi-users (10.4.0)

fastapi-users PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.22.1, =0.23.2 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8...

balify (0.0.2), cognee (>=0.2.1.dev1, <=0.5.2) +35 more potentially affected by CVE-2025-68481 via fastapi-users (14.0.2)

fastapi-users PYPI version 14.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - balify 0.0.2 - cognee =0.2.1.dev1, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 -...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

cognee (>=0.1.23, <=0.1.36) potentially affected by CVE-2025-68481 via fastapi-users (14.0.0)

fastapi-users PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.23, =0.1.36 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

dataset-image-annotator (0.0.19), fastapi-auth-service (>=0.0.3, <=0.0.7) potentially affected by CVE-2025-68481 via fastapi-users (10.2.1)

fastapi-users PYPI version 10.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - dataset-image-annotator 0.0.19 - fastapi-auth-service =0.0.3, =0.0.7 Source cves: CVE-2025-68481 Source advisory:...

Cross-site Request Forgery (CSRF)

Overview fastapi-users is a Ready-to-use and customizable users management for FastAPI Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the generatestatetoken function, which is called with an empty statedata dict, so the resulting JWT contains only the fixe...

CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

CVE-2025-68481

CVE-2025-68481 affects FastAPI Users. Before 15.0.2, OAuth state tokens are generated with an empty state_data, making the JWT contain only a fixed audience and expiry. The callback checks the state JWT but does not tie it to the user session, lacks a correlation cookie or server-side cache, and ...

CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

balify (0.0.2), cognee (>=0.1.23, <=0.5.2) +49 more potentially affected by CVE-2025-68481 via fastapi-users (>=9.2.4, <=14.0.2)

fastapi-users PYPI version =9.2.4, =0.1.23, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 - cognee-community-vector-adapter-redis 0.1.0 - cognee-community-vector-adapter-valkey 0.1.1 and more Source cves: CVE-2025-68481 Source advisory: MEND:CVE-2025-68481...

EUVD-2025-204614

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...