GHSA-c8m8-3jcr-6rj5
High · 8.1CVSS
8.1
EPSS
—
Published
Mar 7, 2026
CISA due date
—
The record
FUXA has a hardcoded fallback JWT signing secret
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @frangoteam/fuxa | 0 | 1.3.0 |
Related vulnerabilities
- CVE-2025-69971 FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. Same vulnerability
- GHSA-p69w-mmfv-xrfj FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Also affects @frangoteam/fuxa
- GHSA-4r4r-4jp4-wwf9 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Also affects @frangoteam/fuxa
- CVE-2025-69985 FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote… Also affects @frangoteam/fuxa
- CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321