PT-2026-25881 · Npm · @Frangoteam/Fuxa

Publicado 2026-03-07 · Atualizado 2026-03-07

OSV

CVSS v4.0

8.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.

If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.

This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-321

Identificadores relacionados

GHSA-C8M8-3JCR-6RJ5

Produtos afetados

@Frangoteam/Fuxa

Referências · 5

• https://github.com/frangoteam/FUXA · Nota
• https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js · Nota
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-69971 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c8m8-3jcr-6rj5 · Aviso do Fabricante