CVE-2026-25894 is an insecure default in FUXA through version 1.2.9, rated 9.8. With authentication on but no administrator JWT secret configured, the app accepts tokens signed with a publicly known key. Attackers can forge admin tokens and run code. Version 1.2.10 fixes it.
What's affected
- Package: fuxa-server on npm (FUXA, the web based SCADA, HMI and dashboard software).
- Affected: versions through 1.2.9.
- Fixed: 1.2.10, and the same release closes the other FUXA CVEs in this series.
- Weakness: insecure default JWT secret, fail open authentication.
How to check if you're exposed
Find the FUXA version in each deployment, and then check who can reach it:
npm ls fuxa-server
docker ps --format '{{.Image}}' | grep -i fuxa
A SCADA or HMI web interface should never be reachable from the internet. Test from outside your plant network that the FUXA port does not answer.
What to do now
- Upgrade FUXA to 1.2.10 or later.
- Take FUXA off the public internet and place it behind a VPN or a segmented network.
- Set a long, random administrator JWT secret in the FUXA settings after upgrading, and treat any older tokens as invalid.
- Check your configuration file to confirm the secret is set.
- Review logs and project files for changes you did not make, and check connected device configurations with your process engineers.
- Plan the upgrade with operations staff, since FUXA sits next to physical equipment.
Why it matters
The record lists CWE-1188, insecure default initialization of a resource, and CWE-321, use of a hard coded cryptographic key. The advisory says the interface could report that it was in secure mode while still accepting tokens signed with a known key, and that the setting for the secret was not available in the UI.
That is the dangerous kind of default: it fails open and it looks secure. An attacker who can sign a token as an administrator can use features meant for automation and scripting to run code in the context of the FUXA service. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
Check your configuration first. The weakness exists when authentication is enabled but no administrator JWT secret was set, so a secure looking setup can still be exposed. Look for the secret in your settings file, and if it is empty, treat the instance as open.
Once upgraded, set a long random secret and keep it in a secret manager rather than the repository. Rotate it after any suspected exposure, since a known or leaked secret allows anyone to mint administrator tokens.
Quick check
How can I tell if my instance used the public key?
If you never set an administrator JWT secret, assume the default applied. Set one and restart so old tokens stop working.
Sources
Last reviewed: 19 October 2026.
