CVE-2025-69971

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2026-02-03

Last modified

2026-02-28

Weaknesses

CWE-798

Affected products

• Fuxa (Frangoteam)

References

• https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js