GitHub Advisoryadvisory · npm

GHSA-c8m8-3jcr-6rj5 FUXA has a hardcoded fallback JWT signing secret

HIGH Published 2026-03-07 Modified 2026-05-11 Official page ↗
Aliases
CVE-2025-69971
Ecosystem
npm
Packages
@frangoteam/fuxa
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-321, CWE-798
Reviewed
2026-03-07

Affected packages

• npm @frangoteam/fuxa: < 1.3.0 → fixed in 1.3.0

Description

FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured. If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication. This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.

Related

Alias · CVE (1)

  • CVE-2025-69971 FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. vulnerability

Weakness · CWE (2)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References