Critical severity9.8OSV Advisory· Published Feb 3, 2026· Updated Jun 17, 2026

CVE-2025-69971

Description

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@frangoteam/fuxanpm	< 1.3.0	1.3.0

Affected products

Frangoteam/FuxaOSV2 versions
untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …+ 1 more
- (no CPE)range: untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …
- cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*
ghsa-coords
pkg:npm/%40frangoteam/fuxa
Range: < 1.3.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-c8m8-3jcr-6rj5ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-69971ghsaADVISORY
github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.jsnvdProductWEB
github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000