{"id":"CVE-2025-69985","aliases":["EUVD-2025-208092","GHSA-4r4r-4jp4-wwf9"],"status":"published","title":"FUXA has JWT Authentication Bypass via HTTP Referer header spoofing","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.06021,"percentile":0.93397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2026-02-24T00:00:00Z","modified":"2026-10-28T02:30:38Z","exploits":[{"source":"exploitdb","id":"EDB-52544","title":"FUXA 1.2.8 - Authentication Bypass + RCE Exploit","type":"webapps","platform":"multiple","date":"2026-04-30","url":"https://www.exploit-db.com/exploits/52544"},{"source":"pocgithub","id":"joshuavanderpoll/CVE-2025-69985","title":"joshuavanderpoll/CVE-2025-69985","date":"2026-02-25","url":"https://github.com/joshuavanderpoll/CVE-2025-69985"},{"source":"pocgithub","id":"kaleth4/CVE-2025-69985","title":"kaleth4/CVE-2025-69985","date":"2026-05-04","url":"https://github.com/kaleth4/CVE-2025-69985"}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@frangoteam/fuxa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.8"}]}]},{"source":"osv","ecosystem":"npm","package":"@frangoteam/fuxa","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.2.8"}]}]}],"products":[{"vendor":"frangoteam","product":"fuxa"}],"references":[{"url":"https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js","tags":["Product","web"]},{"url":"https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69985","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4r4r-4jp4-wwf9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69985.json","tags":["advisory"]},{"url":"https://github.com/frangoteam/FUXA","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-69985","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","status":"published","published":"2026-02-24T00:00:00Z","modified":"2026-02-25T16:31:17.905Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-208092","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","status":"published","published":"2026-02-24T00:00:00Z","modified":"2026-02-25T16:31:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:29.128374Z"}],"ghsa":[{"id":"GHSA-4r4r-4jp4-wwf9","title":"FUXA has JWT Authentication Bypass via HTTP Referer header spoofing","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","status":"published","published":"2026-02-24T18:31:02Z","modified":"2026-02-26T15:45:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2025-69985","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","status":"published","published":"2026-02-24T16:24:07.12Z","modified":"2026-06-17T10:00:56.843Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:01.096037Z"}],"osv":[{"id":"CVE-2025-69985","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","status":"published","published":"2026-02-24T00:00:00Z","modified":"2026-10-28T02:30:38.178477089Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"GHSA-4r4r-4jp4-wwf9","title":"FUXA has JWT Authentication Bypass via HTTP Referer header spoofing","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","status":"published","published":"2026-02-24T18:31:02Z","modified":"2026-02-26T16:11:20.016891Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}