critical9.8
CVE-2025-69971
FUXA has a hardcoded fallback JWT signing secret
Impact
FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured. If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication. This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @frangoteam/fuxa | <= 1.2.11 | 1.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frangoteam | Fuxa | Version 1.2.7 |