CVE-2025-69971 is a critical flaw (CVSS 9.8) in FUXA 1.2.7, the open source web based SCADA and HMI tool. It signs and verifies login tokens with a hard-coded secret in server/api/jwt-helper.js, so attackers can forge admin tokens. The record names no fixed version. Check the FUXA releases.
What's affected
- FUXA v1.2.7, confirmed in the record.
- Affected file: server/api/jwt-helper.js.
- Fixed version: not stated in the record. Check the FUXA repository releases and issues.
How to check if you're exposed
Find your FUXA version in the application or the package file. If you run 1.2.7, treat it as affected. Other versions may share the same code, so look at the project's releases before deciding.
Then check exposure. FUXA often runs on a plant or building network. Confirm that its web port is not reachable from the internet or from general office networks.
What to do now
- Find every FUXA instance and its version.
- Check the FUXA repository for a release that replaces the hard-coded secret, and upgrade if one exists.
- Put FUXA behind a VPN or a reverse proxy with its own authentication.
- Block internet access to the port.
- Treat any exposed instance as possibly compromised and review its projects and settings for changes.
Why it matters
The weakness is CWE-798, use of hard-coded credentials. A signed token is only trustworthy if the signing key is secret. When the key is in published source code, anyone can read it and produce a token that the server accepts.
That reduces authentication to a formality: the attacker can claim to be an administrator without ever logging in. Three FUXA 1.2.7 CVEs were published together, covering this, an upload flaw and a project import flaw, and they can compound each other. The record does not list this CVE as exploited in the wild.
Quick check
Why is a hard-coded JWT secret dangerous?
Anyone who reads the source can sign tokens the server trusts, so they can claim any role, including admin.
Sources
Last reviewed: 19 October 2026.
