CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
Remote attackers can forge admin tokens using a hard-coded secret to bypass authentication and gain full administrative access to FUXA.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69971?
CVE-2025-69971 is a critical vulnerability in n/a, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
Weakness: CWE-798
Which versions are affected by CVE-2025-69971?
2 open source packages ship an affected version, including @frangoteam/fuxa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@frangoteam/fuxa npm | All versions | 1.3.0 |
@frangoteam/fuxa npm | All versions | 1.3.0 |
Products include Frangoteam Fuxa.
How do I fix CVE-2025-69971?
Upgrade @frangoteam/fuxa to 1.3.0 or later.
Is CVE-2025-69971 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69971 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
- CVE-2023-31719 FUXA SQL Injection vulnerability
- CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
- CVE-2026-25894 FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
Sources
Also known as GHSA-c8m8-3jcr-6rj5.