Description
FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.
If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.
This issue has been addressed in version 1.3.
Recommendation
Update the @frangoteam/fuxa package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.2.11
- Patched version(s): 1.3.0
References
Could your website be exposed too?
SmartScanner can check your website for FUXA has a hardcoded fallback JWT signing secret and gives you actionable findings to investigate.
Start a free scanRelated Issues
- FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
- Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments - CVE-2025-13877
- @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289
- FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945
You might also like:
See something that needs correcting? Let us knowUpdated May 11, 2026