CVE-2025-69971

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-03 · updated 2026-06-17
Weakness: CWE-798

Description

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

Affected products

frangoteam FUXA: 1.2.7

References

https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js

Get alerted when CVE-2025-69971 or the next vulnerability affects your stack