# CVE-2025-69985: FUXA authentication bypass in JWT middleware via Referer header spoofing

Source: https://junglewise.ai/threats/cve-2025-69985-fuxa-authentication-bypass-in-jwt-middleware-via-referer-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-69985 · Severity: low · CVSS 3.1 · Published 2026-02-24

FUXA is a web-based SCADA/HMI dashboard software used to visualize and control industrial processes. The vulnerability allows unauthenticated attackers to bypass authentication by spoofing the HTTP Referer header, gaining access to run arbitrary Node.js code on the server. This leads to complete system compromise and can allow attackers to execute commands, modify data, or disrupt critical operations.

Technologies: [Frangoteam FUXA](https://junglewise.ai/threats/technologies/fuxa), [@frangoteam/fuxa (npm)](https://junglewise.ai/threats/technologies/frangoteam-fuxa). Vendors: [Frangoteam](https://junglewise.ai/threats/vendors/frangoteam), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-69985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-69985 being exploited in the wild.

**How severe is CVE-2025-69985?** Low severity, with a CVSS score of 3.1, published 24 February 2026.

**Which products and versions are affected?** Frangoteam FUXA 1.2.8 and prior; @frangoteam/fuxa (npm) SEMVER:introduced=0,last_affected=1.2.8.

**Is there a fix for CVE-2025-69985?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-69985 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-69985?** Check whether you run Frangoteam FUXA or @frangoteam/fuxa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a failure of authentication verification in the JWT middleware located at server/api/jwt-helper.js. The middleware implements an insufficient check that relies on the presence of "/fuxa" in the HTTP Referer header to validate that requests are coming from internal sources, bypassing the normal JWT token requirement. An unauthenticated remote attacker can craft HTTP POST requests to the /api/runscript endpoint with a spoofed Referer header containing "/fuxa" to pass authentication checks. No prerequisites are required (no valid JWT, no login credentials needed). Successful exploitation allows execution of arbitrary Node.js code on the server via the runscript functionality, leading to remote code execution. This is an incomplete fix for an earlier CVE-2023-33831; the current whitelist check is insufficient. Patches should be available in versions after 1.2.8.

## Affected products

- frangoteam FUXA 1.2.8 and prior

## Identifiers

- CVE-2025-69985
- GHSA-4r4r-4jp4-wwf9

## Timeline

- 2026-02-24: disclosed: Vulnerability published on GitHub Advisory Database (GHSA-4r4r-4jp4-wwf9)
- 2025-12-19: other: Proof-of-concept exploit code published demonstrating RCE and admin account takeover

## References

- [https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40](https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40)
- [https://github.com/frangoteam/FUXA](https://github.com/frangoteam/FUXA)
- [https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js](https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js)

## Related threats

- [FUXA authorization bypass in /api/runscript](https://junglewise.ai/threats/cve-2026-42949-a-authorization-bypass-vulnerability-exists-in-the-api-runscript)
- [FUXA /nodered authorization bypass to RCE](https://junglewise.ai/threats/cve-2026-42922-a-authorization-bypass-vulnerability-exists-in-the-nodered)
- [FUXA information disclosure in Node-RED scripts endpoint](https://junglewise.ai/threats/cve-2026-40063-a-information-disclosure-vulnerability-exists-in-the-nodered-fuxa)
- [FUXA unauthenticated information disclosure in Socket.IO handlers](https://junglewise.ai/threats/cve-2026-67440-fuxa-unauthenticated-information-disclosure-in-socket-io-handlers)
- [Frangoteam FUXA privilege escalation in Scheduler API](https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api)