FUXA contains a hard-coded credential vulnerability

Description

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.2.7

References

• GHSA-2r8f-cf6w-x5vq
• CVE-2025-69971
• CWE-798
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• FUXA contains an Unrestricted File Upload vulnerability - CVE-2025-69981
• FUXA contains an insecure default configuration vulnerability - CVE-2025-69970
• FUXA SQL Injection vulnerability (GHSA-p46g-8c3q-89p2) - CVE-2023-31719
• FUXA SQL Injection vulnerability - CVE-2023-31717

Tags:

npm

fuxa-server