Frangoteam Fuxa vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Frangoteam Fuxa: 27 record(s), with affected versions and fixes.
cpe:2.3:a:frangoteam:fuxa

CVE-2025-69971 Critical · 9.8 Public exploit CWE-798 Feb 3, 2026

FUXA Hard-coded JWT Signing Key Authentication Bypass

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

CVE-2025-69970 Critical · 9.3 CWE-1188 Feb 3, 2026

Frangoteam FUXA 1.2.7 Missing Authentication via Insecure Default Configuration

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.