PT-2026-21744 · Fuxa · Fuxa

Published 2026-02-24 · Updated 2026-04-27 · CVE-2025-69985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUXA versions 1.2.8 and prior

Description FUXA versions 1.2.8 and prior contain an Authentication Bypass issue that can lead to Remote Code Execution (RCE). The issue resides in the server/api/jwt-helper.js middleware, which incorrectly relies on the HTTP "Referer" header for validating internal requests. An unauthenticated remote attacker can bypass JWT authentication by manipulating the Referer header to match the server's host. Successful exploitation grants access to the protected /api/runscript endpoint, enabling the attacker to execute arbitrary Node.js code on the server.

Recommendations Versions prior to 1.2.8 should be updated.

Exploit

Fix

RCE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-69985

GHSA-4R4R-4JP4-WWF9

Affected Products

Fuxa

References · 13

• 🔥 https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40 · Exploit
• 🔥 https://exploit-db.com/exploits/52544 · Exploit
• https://osv.dev/vulnerability/CVE-2025-69985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69985 · Security Note
• https://osv.dev/vulnerability/GHSA-4r4r-4jp4-wwf9 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js · Note
• https://twitter.com/VulmonFeeds/status/2026432871926239688 · Twitter Post
• https://twitter.com/CVEnew/status/2027841538571833691 · Twitter Post
• https://twitter.com/cracbot/status/2028062894353797574 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027842730802463131 · Twitter Post
• https://t.me/CVEtracker/45615 · Telegram Post
• https://twitter.com/Junior_Baines/status/2048906462970450111 · Twitter Post