CVE-2026-25894 FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

What is CVE-2026-25894?

CVE-2026-25894 is a critical vulnerability in frangoteam FUXA, published on 9 Feb 2026.

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.

Weakness: CWE-321, CWE-1188

Which versions are affected by CVE-2026-25894?

2 open source packages ship an affected version, including fuxa-server. It affects 1 product.

Products include Frangoteam Fuxa.

How do I fix CVE-2026-25894?

Upgrade fuxa-server to 1.2.10 or later.

Is CVE-2026-25894 being exploited?

There is no known exploitation of CVE-2026-25894 in the wild and no public exploit code.

Other vulnerabilities in frangoteam FUXA

• CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting Critical 10.0
• CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Critical 9.8
• CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret Critical 9.8
• CVE-2023-31719 FUXA SQL Injection vulnerability Critical 9.8
• CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-32cc-x95p-fxcg.