CVE Intelligence
Analysis AI-assisted

CVE-2025-69971: FUXA Hard-coded JWT Signing Key Authentication Bypass

CVE-2025-69971 affects FUXA v1.2.7, where the JWT helper in server/api/jwt-helper.js signs and verifies tokens with a hard-coded secret, classified as CWE-798. According to the record, a remote attacker could forge administrator tokens and gain full administrative access. NVD rates it Critical with CVSS 3.1 score 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-69971 affects FUXA v1.2.7, a product from Frangoteam. According to the record, the application signs and verifies JWT tokens with a secret key hard-coded in server/api/jwt-helper.js, a weakness classified as CWE-798.

Impact

  • According to the record, a remote attacker could forge valid administrator tokens.
  • The record states that this allows bypassing authentication and gaining full administrative access.
  • NVD assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, no privileges required and no user interaction.

Affected products and versions

  • Frangoteam Fuxa, version 1.2.7, as listed in the record.
  • The record does not state whether other versions are affected; this is unknown.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
  • The record contains no exploit details, and this analysis does not provide any.

Remediation and mitigation

  • The record contains no fixed version or vendor patch. The absence of a fix in the record does not mean none exists, so check the upstream FUXA source file and the project for updates.
  • Because the secret is embedded in source code, changing configuration alone may not be sufficient. Moving the signing secret to a protected, deployment-specific source is the typical direction for a fix (inference).
  • Restrict network access to FUXA administrative interfaces and avoid exposing the service to untrusted networks.
  • Treat tokens signed with the known key as potentially forgeable. After any secret change, invalidate existing sessions.

Detection guidance

  • Review authentication logs for administrative actions that lack a matching legitimate login or come from unexpected sources.
  • Monitor for unexpected changes to users, roles or configuration in the FUXA instance.
  • Confirm whether deployed builds contain the affected file and the same hard-coded key behavior.

Limitations of the available information

  • The record does not include a vendor advisory, a fixed version or evidence of exploitation.
  • Only the source file is listed as a product reference, so the affected range beyond version 1.2.7 is unknown.
  • Technical details beyond the record's description are not documented here.

Frequently asked questions

What is CVE-2025-69971?

It is a hard-coded credential weakness in FUXA v1.2.7. The JWT signing secret is embedded in server/api/jwt-helper.js, which according to the record could let remote attackers forge administrator tokens.

Is there a fixed version?

The record does not list a fixed version. This does not mean no fix exists, so check the upstream project for updates.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.