CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
Remote attackers can bypass authentication by spoofing the Referer header to execute arbitrary code on FUXA servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-69985?
CVE-2025-69985 is a critical authentication bypass vulnerability in n/a, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
Weakness: CWE-288
Which versions are affected by CVE-2025-69985?
2 open source packages ship an affected version, including @frangoteam/fuxa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@frangoteam/fuxa npm | All versions to 1.2.8 | None |
@frangoteam/fuxa npm | All versions to 1.2.8 | None |
Products include Frangoteam Fuxa.
How do I fix CVE-2025-69985?
No fix has been published for CVE-2025-69985 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-69985 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69985 exists.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
- CVE-2023-31719 FUXA SQL Injection vulnerability
- CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
- CVE-2026-25894 FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
Sources
Also known as GHSA-4r4r-4jp4-wwf9.