Critical Unauthenticated Remote Code Execution in FUXA Server due to Hardcoded JWT Secret
Summary
GHSA-32cc-x95p-fxcg: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration. Affects fuxa-server versions < 1.2.10. Fixed in 1.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FUXA is an open-source server application designed for automation and scripting in various environments, including ICS/SCADA systems. It provides administrative APIs that allow users to manage and control connected devices and services. However, an insecure default configuration in FUXA versions up to 1.2.9 exposes it to serious security risks, particularly when authentication is enabled but the JWT secret is not properly configured.
Vulnerability Detail
The vulnerability arises from a hardcoded JWT secret in the default configuration of FUXA, which allows unauthenticated remote attackers to gain administrative access. This issue is particularly concerning as it permits attackers to forge JWTs, bypass authentication mechanisms, and execute arbitrary code on the server. The implications of this vulnerability can lead to full system compromise, especially in environments that rely on FUXA for critical operations.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.10
This is the first release that contains the fix.
npm install fuxa-server@1.2.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually configure a secure JWT secret in the FUXA configuration file. This can be done by adding a line in the configuration settings that specifies a custom JWT secret, ensuring that it is not left as the default hardcoded value.
Conclusion
The vulnerability in FUXA due to a hardcoded JWT secret poses significant risks to users, allowing for unauthenticated remote code execution. It is crucial for administrators to update to the patched version and implement secure configurations to protect their systems.
See every vulnerability recorded for fuxa-server →
FAQ
The CVSS score of this vulnerability is 9.5, indicating a critical level of severity.
FUXA versions up to 1.2.9 are affected. Users should upgrade to version 1.2.10 or later.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability can lead to unauthorized administrative access, potential data breaches, and full system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
