CVE-2025-69985: Frangoteam Fuxa

Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days.

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.

Affected products

• Frangoteam Fuxa: up to and including 1.2.8

Published 2026-02-24. Last modified 2026-06-17.