CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

What is CVE-2026-25893?

CVE-2026-25893 is a critical authentication bypass vulnerability in frangoteam FUXA, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

Weakness: CWE-287, CWE-285

Which versions are affected by CVE-2026-25893?

2 open source packages ship an affected version, including fuxa-server. It affects 1 product.

Products include Frangoteam Fuxa.

How do I fix CVE-2026-25893?

Upgrade fuxa-server to 1.2.10 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-25893 being exploited?

There is no known exploitation of CVE-2026-25893 in the wild and no public exploit code.

Other vulnerabilities in frangoteam FUXA

• CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Critical 9.8
• CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret Critical 9.8
• CVE-2023-31719 FUXA SQL Injection vulnerability Critical 9.8
• CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA Critical 9.8
• CVE-2026-25894 FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration Critical 9.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vwcg-c828-9822.