Description
FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.
If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.
This issue has been addressed in version 1.3.
Recommendation
Update the @frangoteam/fuxa package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.2.11
- Patched version(s): 1.3.0
References
Could your website be exposed too?
SmartScanner can check your website for FUXA has a hardcoded fallback JWT signing secret and gives you actionable findings to investigate.
Start a free scanRelated Issues
- FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
- Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments - CVE-2025-13877
- `sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js` - CVE-2025-62381
- matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
You might also like:
See something that needs correcting? Let us knowUpdated May 11, 2026