Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-69971 FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. Th… https://www.cve.org/CVERecord?id=CVE-2025-69971
Post summary
A hard‑coded secret key in FUXA v1.2.7’s JWT helper exposes a credential vulnerability, but no exploit details, PoC, or patch are mentioned.
🚨 CVE-2025-69971 - critical 🚨 FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass > FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-co... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-69971 @pdnuclei #NucleiTemplates #cve
Post summary
CVE-2025-69971 is a critical vulnerability in FUXA versions ≤1.2.7, caused by a hard‑coded JWT secret that allows authentication bypass; a link to a detection library is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | frangoteam | fuxa | 1.2.7 | - | - |