CVE-2025-69985
Critical · 9.8CVSS
9.8
EPSS
5.5%
Published
Feb 24, 2026
CISA due date
—
The record
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @frangoteam/fuxa | 0 | No fix |
Related vulnerabilities
- GHSA-4r4r-4jp4-wwf9 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Same vulnerability
- GHSA-p69w-mmfv-xrfj FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- GHSA-c8m8-3jcr-6rj5 FUXA has a hardcoded fallback JWT signing secret Also affects @frangoteam/fuxa
- CVE-2025-69971 FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. Also affects @frangoteam/fuxa
- CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
- CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
- CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288