CVE-2025-69971 in FUXA

Riassunto

di MITRE • 03/02/2026

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsabile: MITRE
• Prenotare: 09/01/2026
• Divulgazione: 03/02/2026
• Moderazione: accettato
• Voce: VDB-344134
• CPE: pronto
• CWE: CWE-798 (confermato)
• CVSS: 9.8 (NVD)
• EPSS: 0.02036
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-69971
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-69971
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-69971/