https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T12:03:59.081127+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273801 EUVD-2026-273801 2026-10-09T12:03:59.127040+00:00 EUVD-2026-273801 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69971 fkie_cve-2025-69971 2026-10-09T12:03:59.127075+00:00

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

 https://cve.radiocsirt.org/vuln/ghsa-c8m8-3jcr-6rj5 GHSA-c8m8-3jcr-6rj5 — FUXA has a hardcoded fallback JWT signing secret 2026-10-09T12:03:59.127107+00:00

Affected: npm: @frangoteam/fuxa

FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured.

If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.

This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.