10

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25893

CVE-2026-25893: FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25893

CVE-2026-25893:

10

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	<= 1.2.9	1.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass in FUXA, enabling an unauthenticated remote attacker to gain administrative access. The root cause is the combination of two main flaws. First, the /api/heartbeat endpoint, configured in the init function in server/api/index.js, allowed for token renewal requests without first checking if the user was authenticated. Second, the getNewToken function in server/api/jwt-helper.js, which was called by the heartbeat endpoint, insecurely created a new JSON Web Token (JWT) based on the unvalidated x-auth-user header sent by the client.

An attacker could exploit this by sending a POST request to /api/heartbeat with a crafted x-auth-user header (e.g., {"user":"admin","groups":["admin"]}). The verifyToken middleware would fail to authenticate the request but would allow it to proceed. The heartbeat handler would then call getNewToken, which would mint a new JWT with administrative privileges based on the attacker-controlled header. This grants the attacker full administrative access, leading to potential remote code execution.

The patch addresses these issues by:

Modifying the verifyToken middleware to explicitly set an isAuthenticated flag on the request.
Adding a check in the /api/heartbeat handler to ensure req.isAuthenticated is true before attempting to refresh a token.
Replacing the insecure getNewToken function with getNewTokenFromRequest, which creates a token based on the trusted, server-side user identity established during authentication, rather than a client-controlled header.

Vulnerable functions

init

server/api/index.js

The `init` function sets up the `/api/heartbeat` endpoint. The vulnerable version of this endpoint's handler would call `authJwt.getNewToken` to issue a new token without verifying if the request was from an authenticated user. An attacker could send a request with `"params": true` in the body to trigger a token refresh, which would then call the vulnerable `getNewToken` function.

getNewToken

server/api/jwt-helper.js

This function was responsible for generating a new JWT. It insecurely trusted the `x-auth-user` header provided by the client. An unauthenticated attacker could craft this header to specify arbitrary user details (e.g., `{"user":"admin","groups":["admin"]}`) and receive a valid JWT with those privileges, effectively bypassing authentication.

verifyToken

server/api/jwt-helper.js

The `verifyToken` middleware, in its vulnerable state, failed to properly flag unauthenticated requests. If a token was missing or invalid, it would proceed to the next handler without setting an authentication status. This allowed the unauthenticated request to reach the `/api/heartbeat` endpoint, which would then incorrectly proceed with token renewal. The patch ensures that an `isAuthenticated` flag is explicitly set to `true` or `false`, which is then checked by the heartbeat handler.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.