CVE-2025-69971: frangoteam FUXA hardcoded JWT signing secret fallback

Executive brief

FUXA, an open-source industrial web-based SCADA/HMI platform, contains a security flaw where it uses a publicly known, hardcoded password to sign digital login tokens. If an administrator has not manually configured a custom security key, an attacker can use this known password to create their own valid login tokens. This allows an unauthorized user to bypass authentication entirely and gain full access to the system and its industrial controls.

Technical details

FUXA (up to version 1.2.11) utilizes a hardcoded fallback JWT signing secret ('frangoteam751') within its `jwt-helper.js` component. When the `secretCode` configuration is left empty, the application defaults to this static string to sign JSON Web Tokens. A remote, unauthenticated attacker can exploit this by manually crafting and signing a JWT using the known secret, granting them unauthorized administrative access to the web interface. The vulnerability is classified as CWE-321 (Use of Hard-coded Cryptographic Key) and has been remediated in version 1.3.0 by implementing secure random secret generation when no custom code is provided.

Affected products

• frangoteam FUXA <= 1.2.11

Timeline

• 2026-03-07: advisory: GitHub Advisory GHSA-c8m8-3jcr-6rj5 published
• 2026-03-07: patched: Issue addressed in version 1.3.0

References

• https://api.github.com/users/blankshiro
• https://github.com/blankshiro
• https://api.github.com/users/blankshiro/gists%7B/gist_id%7D
• https://api.github.com/users/blankshiro/repos
• https://avatars.githubusercontent.com/u/61448100?v=4
• https://api.github.com/users/blankshiro/events%7B/privacy%7D