CVE-2026-25893 is an authentication bypass in FUXA through version 1.2.9, rated 9.8. The heartbeat refresh API can be abused to mint administrator tokens, which then allow arbitrary code execution on the server. This applies when authentication is enabled. Upgrade to 1.2.10.
What's affected
- Package: fuxa-server on npm (FUXA, the web based SCADA, HMI and dashboard software).
- Affected: versions through 1.2.9.
- Fixed: 1.2.10, and the same release closes the other FUXA CVEs in this series.
- Weakness: authentication bypass through the heartbeat refresh endpoint.
How to check if you're exposed
Find the FUXA version in each deployment, and then check who can reach it:
npm ls fuxa-server
docker ps --format '{{.Image}}' | grep -i fuxa
A SCADA or HMI web interface should never be reachable from the internet. Test from outside your plant network that the FUXA port does not answer.
What to do now
- Upgrade FUXA to 1.2.10 or later.
- Take FUXA off the public internet and place it behind a VPN or a segmented network.
- Rotate the JWT signing secret and invalidate existing sessions after the upgrade.
- Review logs and project files for changes you did not make, and check connected device configurations with your process engineers.
- Plan the upgrade with operations staff, since FUXA sits next to physical equipment.
Why it matters
The record lists CWE-285, improper authorization, and CWE-287, improper authentication. The advisory says the heartbeat refresh endpoint can be used to mint administrator JWTs when authentication is turned on.
The advisory includes a note that matters: this is not the same as the earlier issue where authentication is off by default. Enabling authentication did not protect you here, so an admin who did the right thing was still exposed. With administrator access, the built in scripting features can be used to run code on the server, which is why the score is 9.8. The record does not mark it as exploited in the wild.
How to prioritise the fix
The note in the advisory is the key point: enabling authentication does not stop this, and the project points out that GitHub's earlier grouping with a different CVE could mislead people into thinking it does. Do not rely on the secureEnabled setting as a mitigation.
Plan the upgrade to 1.2.10 and rotate the JWT signing secret as part of it. Any token minted during the exposure period should be treated as untrusted, and rotating the secret invalidates them.
If the instance has been reachable from untrusted networks, review it for scripts or project changes that you did not make. The attacker path described ends in code execution, so a compromised host may need to be rebuilt rather than cleaned.
Quick check
Does turning on authentication protect me?
Not against this bug. The advisory says it applies when authentication is enabled.
Sources
Last reviewed: 19 October 2026.
