Critical Unauthenticated Remote Code Execution in FUXA Server
Summary
GHSA-vwcg-c828-9822: FUXA Unauthenticated Remote Code Execution via Admin JWT Minting. Affects fuxa-server versions < 1.2.10. Fixed in 1.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source server designed for automation and scripting, particularly in industrial control systems (ICS) and supervisory control and data acquisition (SCADA) environments. It provides a range of administrative APIs that allow users to manage and automate tasks. However, a critical vulnerability has been identified that allows unauthenticated attackers to gain administrative access and execute arbitrary code, posing significant risks to affected deployments.
Vulnerability Detail
An authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This issue arises when the runtime.settings.secureEnabled configuration is set to true, enabling the attacker to bypass all authentication mechanisms. The ramifications of this vulnerability are severe, potentially leading to full system compromise and exposing connected ICS/SCADA environments to further exploitation. The vulnerability affects FUXA versions up to 1.2.9 and has a CVSS score of 10.0, indicating critical severity.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.10
This is the first release that contains the fix.
npm install fuxa-server@1.2.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the runtime.settings.secureEnabled setting, but this is not recommended as it exposes the system to other risks. The best course of action is to apply the patch as soon as possible.
Conclusion
The authentication bypass vulnerability in FUXA poses a critical risk to users, allowing unauthenticated attackers to execute arbitrary code. It is essential for users to update to version 1.2.10 or later to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for fuxa-server →
FAQ
The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the server due to an authentication bypass.
FUXA versions up to 1.2.9 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the runtime.settings.secureEnabled setting as a temporary workaround, but be aware that this may expose your system to other vulnerabilities.
Exploitation can lead to full system compromise, allowing attackers to interact with administrative APIs and execute arbitrary code, which may further jeopardize connected ICS/SCADA environments.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
