GHSA-4r4r-4jp4-wwf9
Critical · 9.8CVSS
9.8
EPSS
—
Published
Feb 24, 2026
CISA due date
—
The record
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @frangoteam/fuxa | 0 | No fix |
Related vulnerabilities
- CVE-2025-69985 FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote… Same vulnerability
- GHSA-p69w-mmfv-xrfj FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- GHSA-c8m8-3jcr-6rj5 FUXA has a hardcoded fallback JWT signing secret Also affects @frangoteam/fuxa
- CVE-2025-69971 FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. Also affects @frangoteam/fuxa
- CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
- CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
- CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288