CVE-2025-69971: Frangoteam Fuxa

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

Affected products

• Frangoteam Fuxa: version 1.2.7 only

Published 2026-02-03. Last modified 2026-06-17.