CVE-2025-69971

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

CVSS v4.0 GitHub

8.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GitHub

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

2.23% chance of exploitation in the next 30 days, 82nd percentile

Nuclei

critical · CWE-321

Published

2026-02-03

Updated

2026-02-28

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69971.yaml

Security advisories

• advisories/GHSA-c8m8-3jcr-6rj5
• frangoteam/FUXA/blob/master/server/api/jwt-helper.js

References

• CVE Record
• NVD entry