AIKIDO-2026-209561
fastapi-guard is vulnerable to Improper Access Control
75
High Risk
This Affects:
fastapi-guardTL;DR
The security middleware extends Starlette's BaseHTTPMiddleware, which only runs for HTTP scopes and is skipped entirely for WebSocket connections. As a result WebSocket handshakes bypass every middleware security check, including IP allow and deny lists, active IP bans, rate limiting, penetration detection, and emergency lockdown. A banned or blocked client can still open a WebSocket and receive data that would be refused over HTTP, while the documentation implies the connections are protected. The fix adds a guard_websocket dependency that enforces bans, allowlists, country restrictions, and rate limits before a WebSocket is accepted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose WebSocket endpoints and rely on the security middleware to enforce IP bans, allowlists, country restrictions, or rate limits on them.
Background info
fastapi-guard is vulnerable to Improper Access Control in versions 0.2.0 - 7.7.0.
How to fix this
Upgrade the fastapi-guard library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.