{"id":"GHSA-c8m8-3jcr-6rj5","summary":"FUXA has a hardcoded fallback JWT signing secret","details":"FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured.\n\nIf authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.\n\nThis issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.","aliases":["CVE-2025-69971"],"modified":"2026-05-11T16:41:13.935540Z","published":"2026-03-07T02:31:18Z","database_specific":{"github_reviewed_at":"2026-03-07T02:31:18Z","nvd_published_at":null,"cwe_ids":["CWE-321","CWE-798"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69971"},{"type":"PACKAGE","url":"https://github.com/frangoteam/FUXA"},{"type":"WEB","url":"https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js"}],"affected":[{"package":{"name":"@frangoteam/fuxa","ecosystem":"npm","purl":"pkg:npm/%40frangoteam/fuxa"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.2.11","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c8m8-3jcr-6rj5/GHSA-c8m8-3jcr-6rj5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"}]}