High severityOSV Advisory· Published Feb 3, 2026· Updated Feb 28, 2026

CVE-2025-69971

Description

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@frangoteam/fuxanpm	< 1.3.0	1.3.0

Affected products

Frangoteam/FuxaOSV
Range: untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-c8m8-3jcr-6rj5ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-69971ghsaADVISORY
github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.jsghsaWEB
github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000