PT-2026-5979

CVE-2025-69971

Published

2026-02-03

Updated

2026-03-07

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUXA version 1.2.7

Description The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication, potentially gaining full administrative access. The vulnerable component is located in the file server/api/jwt-helper.js. The JWT Tokens are used for authentication.

Recommendations Replace the hard-coded secret key with a dynamically generated and securely stored key.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-798: Use of Hard-coded Credentials

CWE-321: Use of Hard-coded Cryptographic Key

Related identifiers

CVE-2025-69971