Sign in
Deutsch English Español Polski
Critical

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

  • Disclosed: 05.02.2026
  • Updated: 11.10.2026 10:22

Note

GitHub incorrectly stated this vulnerability is identical to CVE-2025-69970, which describes the fact that authentication is disabled by default. This advisory describes an exploit chain that enables authentication bypass via the heartbeat refresh endpoint when authentication is enabled. This misleads users into thinking that enabling authentication would mitigate this vulnerability. Please see the patch for more information: https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb.

Description

An authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled. This issue has been patched in FUXA version 1.2.10.

Impact

Affected deployments are those with runtime.settings.secureEnabled set to true.

Exploitation allows an unauthenticated, remote attacker to bypass all authentication mechanisms and obtain administrative access to the FUXA instance by minting administrator JWTs via the heartbeat refresh endpoint. With these elevated privileges, the attacker can interact with administrative APIs, including intended features designed for automation and scripting, to execute arbitrary code in the context of the FUXA service. Depending on deployment configuration and permissions, this may lead to full system compromise and could further expose connected ICS/SCADA environments to follow-on actions.

Patches

This issue has been patched in FUXA version 1.2.10. Users are strongly encouraged to update to the latest available release.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fuxa-server < 1.2.10 1.2.10

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE)
CWE-285, CWE-287
Platform
npm
Package
fuxa-server
Disclosed
05.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-vwcg-c828-9822 - CC BY 4.0

Vulnerability history: fuxa-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
09.2023 06.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 10
  • Medium 3

Disclosures per year

Severity:
  1. FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
    High · 8.2 CVE-2026-47719 <= 1.1.14-1243 no fix
  2. FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
    High · 7.5 CVE-2026-47717 >= 1.3.0, < 1.3.1 1.3.1
  3. FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
    High CVE-2026-43947 >= 1.3.0, < 1.3.1 1.3.1
  4. FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
    High CVE-2026-43946 >= 1.3.0, < 1.3.1 1.3.1
  5. FUXA Affected by a Path Traversal Sanitization Bypass
    High CVE-2026-25951 < 1.2.11 1.2.11
  6. FUXA Unauthenticated Remote Arbitrary Scheduler Write
    Critical CVE-2026-25939 >= 1.2.8, < 1.2.11 1.2.11
  7. FUXA Unauthenticated Remote Code Execution in Node-RED Integration
    Critical CVE-2026-25938 >= 1.2.8, < 1.2.11 1.2.11
  8. FUXA Unauthenticated Remote Arbitrary Device Tag Write
    Critical CVE-2026-25752 < 1.2.10 1.2.10
  9. FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
    Critical CVE-2026-25895 < 1.2.10 1.2.10
  10. FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
    Critical CVE-2026-25894 < 1.2.10 1.2.10
  11. FUXA Unauthenticated Exposure of Plaintext Database Credentials
    Critical CVE-2026-25751 < 1.2.10 1.2.10
  12. FUXA Unauthenticated Remote Code Execution via Admin JWT Minting this entry
    Critical CVE-2026-25893 < 1.2.10 1.2.10
  13. FUXA allows Remote Code Execution (RCE) via the project import functionality.
    High · 9.8 CVE-2025-69983 <= 1.2.7 no fix
  14. FUXA contains an Unrestricted File Upload vulnerability
    High CVE-2025-69981 <= 1.2.7 no fix
  15. FUXA contains an insecure default configuration vulnerability
    High CVE-2025-69970 <= 1.2.7 no fix
  16. FUXA SQL Injection vulnerability
    Critical · 9.8 CVE-2023-31719 <= 1.1.12 no fix
  17. FUXA local file inclusion vulnerability
    High · 7.5 CVE-2023-31718 <= 1.1.12 no fix
  18. FUXA SQL Injection vulnerability
    High · 7.5 CVE-2023-31717 <= 1.1.12 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.