High severityOSV Advisory· Published Feb 3, 2026· Updated Feb 9, 2026

CVE-2025-69970

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
fuxa-servernpm	<= 1.2.7	—

Affected products

Frangoteam/FuxaOSV
Range: untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-r5m2-fqcf-qrf7ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-69970ghsaADVISORY
github.com/frangoteam/FUXA/blob/master/server/settings.default.jsghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000