High severityOSV Advisory· Published Feb 3, 2026· Updated Feb 9, 2026

CVE-2025-69970

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
fuxa-servernpm	<= 1.2.7	—

Affected products

Frangoteam/FuxaOSV
Range: untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …
ghsa-coords
pkg:npm/fuxa-server
Range: <= 1.2.7

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-r5m2-fqcf-qrf7ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-69970ghsaADVISORY
github.com/frangoteam/FUXA/blobghsaPACKAGE
github.com/frangoteam/FUXA/blob/master/server/settings.default.jsghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000