GitHub Advisoryadvisory · npm

GHSA-r5m2-fqcf-qrf7 FUXA contains an insecure default configuration vulnerability

HIGH Published 2026-02-03 Modified 2026-02-04 Official page ↗
Aliases
CVE-2025-69970
Ecosystem
npm
Packages
fuxa-server
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-1188, CWE-306
Reviewed
2026-02-04

Affected packages

• npm fuxa-server: <= 1.2.7 (no fix yet)

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

Related

Alias · CVE (1)

  • CVE-2025-69970 FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. vulnerability

Weakness · CWE (2)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References