PT-2026-25881 · Npm · @Frangoteam/Fuxa

Published 2026-03-07 · Updated 2026-03-07

OSV

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.

If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.

This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

GHSA-C8M8-3JCR-6RJ5

Affected Products

@Frangoteam/Fuxa

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-69971 · Security Note
• https://osv.dev/vulnerability/GHSA-c8m8-3jcr-6rj5 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js · Note
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5 · Note