Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

FUXA has a hardcoded secret that can be used to fake authentication

published 9 months ago
Summary

A default secret in FUXA can be used by an attacker to create fake login tokens, potentially allowing unauthorized access. This issue has been fixed in version 1.3.0, but until then, it's essential to set a custom secret code for FUXA authentication.

What to do
  • Update frangoteam @frangoteam/fuxa to version 1.3.0.
Affected software
Ecosystem VendorProductAffected versions
npm frangoteam @frangoteam/fuxa < 1.3.0
Fix: upgrade to 1.3.0
npm frangoteam fuxa-server <= 1.2.7
– frangoteam fuxa 1.2.7
cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*
Original advisory text
Duplicate Advisory: FUXA contains a hard-coded credential vulnerability
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-c8m8-3jcr-6rj5. This link is maintained to preserve external references.

### Original Description
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
CWE-798Use of Hard-coded Credentials
Timeline
Published3 Feb 2026
Updated11 May 2026
First seen7 Mar 2026
Sources
GHSA-c8m8-3jcr-6rj5 · OSV
Track software like this
Free during beta