CVE-2025-69971
Critical · 9.8CVSS
9.8
EPSS
2.2%
Published
Feb 3, 2026
CISA due date
—
The record
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @frangoteam/fuxa | 0 | 1.3.0 |
| npm | fuxa-server | 0 | No fix |
Related vulnerabilities
- GHSA-2r8f-cf6w-x5vq Duplicate Advisory: FUXA contains a hard-coded credential vulnerability Same vulnerability
- GHSA-c8m8-3jcr-6rj5 FUXA has a hardcoded fallback JWT signing secret Same vulnerability
- GHSA-p69w-mmfv-xrfj FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- GHSA-4r4r-4jp4-wwf9 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Also affects @frangoteam/fuxa
- CVE-2025-69985 FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote… Also affects @frangoteam/fuxa
- CVE-2026-47720 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
- CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server