9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69971

CVE-2025-69971: FUXA contains a hard-coded credential vulnerability

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69971

CVE-2025-69971:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	<= 1.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the application uses a hard-coded secret key, 'frangoteam751', for signing and verifying JWTs. This is explicitly defined in the server/api/jwt-helper.js file. An attacker who knows this secret can forge JWTs with arbitrary claims, such as administrative privileges. The functions verify, verifyToken, and requireAuth are directly responsible for verifying incoming tokens. During an exploit, one of these functions would be called to process the forged token. The function would incorrectly validate the token because it was signed with the correct, albeit hard-coded, secret. This allows the attacker to bypass authentication and gain unauthorized access to the application, including administrative functions. The functions getNewTokenFromRequest and getGuestToken are also included as they are part of the insecure token management system that relies on this static, publicly known secret.

Vulnerable functions

verify

server/api/jwt-helper.js

This function uses a hard-coded secret ('frangoteam751') to verify JWT tokens. An attacker can forge a token, sign it with the known secret, and this function will validate it as authentic, leading to an authentication bypass.

verifyToken

server/api/jwt-helper.js

This middleware function verifies a JWT from the request headers using a hard-coded secret ('frangoteam751'). A remote attacker can craft a malicious JWT, sign it with the compromised secret, and send it in the 'x-access-token' header to bypass authentication checks.

requireAuth

server/api/jwt-helper.js

This middleware function enforces authentication by verifying a JWT using the hard-coded secret ('frangoteam751'). It is intended to protect routes, but an attacker can forge a valid token to gain unauthorized access to protected API endpoints.

getNewTokenFromRequest

server/api/jwt-helper.js

This function signs a new JWT using the hard-coded secret ('frangoteam751'). While it generates tokens rather than verifying them, it is part of the vulnerable authentication scheme that relies on a compromised, static secret.

getGuestToken

server/api/jwt-helper.js

This function signs a guest JWT using the hard-coded secret ('frangoteam751'). It contributes to the overall vulnerability by using the compromised secret for token generation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.