critical9.8Public exploit code
CVE-2025-69985
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FUXA 1.2.8 - Authentication Bypass + RCE Exploit2026-04-30 · webapps · multiple
Impact
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @frangoteam/fuxa | <= 1.2.8 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frangoteam | Fuxa | through 1.2.8 |