FastAPI Security Hunting

Hunt FastAPI-specific vulnerabilities in dependency injection authorization gaps, Pydantic model coercion and extra field exploitation, OpenAPI schema mining for hidden endpoints, and ASGI middleware bypasses. FastAPI's design — dependency injection for auth, Pydantic for validation, OpenAPI auto-generation — creates unique attack surface distinct from Flask or Django.

When to Use

• Target uses FastAPI (indicated by /docs, /redoc, /openapi.json, or server: uvicorn).
• OpenAPI schema is publicly accessible.
• API uses dependency injection (Depends) for authorization.
• WebSocket endpoints exist alongside REST API.
• Application uses Pydantic v1 or v2 for request validation.

Quick Detection