{"id":"CVE-2025-69971","aliases":["EUVD-2025-206717","GHSA-2r8f-cf6w-x5vq","GHSA-c8m8-3jcr-6rj5"],"status":"published","title":"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability","description":"FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02174,"percentile":0.8244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-321","CWE-798"],"published":"2026-02-03T00:00:00Z","modified":"2026-10-28T02:30:47Z","exploits":[{"source":"nuclei","id":"CVE-2025-69971","title":"FUXA \u003c= 1.2.7 - Hardcoded JWT Secret Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69971.yaml"}],"fixes":[{"ecosystem":"npm","package":"@frangoteam/fuxa","fixed_in":["1.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@frangoteam/fuxa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.11"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@frangoteam/fuxa","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]}],"products":[{"vendor":"frangoteam","product":"fuxa"}],"references":[{"url":"https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js","tags":["Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69971","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2r8f-cf6w-x5vq"},{"url":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c8m8-3jcr-6rj5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69971.json","tags":["advisory"]},{"url":"https://github.com/frangoteam/FUXA","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-69971","description":"FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-02-28T02:59:59.337Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-206717","description":"FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-02-28T02:59:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:13.147525Z"}],"ghsa":[{"id":"GHSA-2r8f-cf6w-x5vq","title":"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-c8m8-3jcr-6rj5. This link is maintained to preserve external references.\n\n### Original Description\nFUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","status":"withdrawn","published":"2026-02-03T18:30:47Z","modified":"2026-05-11T16:21:54Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-c8m8-3jcr-6rj5","title":"FUXA has a hardcoded fallback JWT signing secret","description":"FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured.\n\nIf authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.\n\nThis issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.","status":"published","published":"2026-03-07T02:31:18Z","modified":"2026-05-11T16:22:18Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-321","CWE-798"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2025-69971","description":"FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","status":"published","published":"2026-02-03T18:16:17.37Z","modified":"2026-06-17T10:00:56.367Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:11:59.832225Z"}],"osv":[{"id":"CVE-2025-69971","description":"FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-10-28T02:30:47.228265842Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"GHSA-2r8f-cf6w-x5vq","title":"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-c8m8-3jcr-6rj5. This link is maintained to preserve external references.\n\n### Original Description\nFUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.","status":"withdrawn","published":"2026-02-03T18:30:47Z","modified":"2026-09-10T03:50:33.820511404Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GHSA-c8m8-3jcr-6rj5","title":"FUXA has a hardcoded fallback JWT signing secret","description":"FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured.\n\nIf authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.\n\nThis issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.","status":"published","published":"2026-03-07T02:31:18Z","modified":"2026-05-11T16:41:13.93554Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-321","CWE-798"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}