CVE-2021-32677

CVE-2021-32677 describes a Cross-Site Request Forgery (CSRF) vulnerability in FastAPI versions prior to 0.65.2, affecting applications that use cookies for authentication and process JSON payloads. The flaw allowed FastAPI to parse JSON data from requests with a text/plain content-type, bypassing CORS preflights and enabling attackers to execute malicious actions on behalf of authenticated users. With a CVSS score of 8.1 (High), this vulnerability has a network attack vector, low attack complexity, and can lead to high confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.