PT-2026-5979 · Fuxa · Fuxa

Published 2026-02-03 · Updated 2026-03-07 · CVE-2025-69971

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUXA version 1.2.7

Description The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication, potentially gaining full administrative access. The vulnerable component is located in the file server/api/jwt-helper.js. The JWT Tokens are used for authentication.

Recommendations Replace the hard-coded secret key with a dynamically generated and securely stored key.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2025-69971

GHSA-2R8F-CF6W-X5VQ

GHSA-C8M8-3JCR-6RJ5

Affected Products

Fuxa

References · 11

• https://osv.dev/vulnerability/GHSA-c8m8-3jcr-6rj5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69971 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r8f-cf6w-x5vq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69971 · Security Note
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js · Note
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5 · Note
• https://twitter.com/pdnuclei_bot/status/2023487580579463244 · Twitter Post
• https://t.me/CVEtracker/43617 · Telegram Post
• https://t.me/cveNotify/151569 · Telegram Post
• https://t.me/cveNotify/153635 · Telegram Post