# CVE-2026-25893: FUXA authentication bypass and remote code execution via heartbeat refresh API

Source: https://junglewise.ai/threats/cve-2026-25893-fuxa-authentication-bypass-and-remote-code-execution-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25893 · Severity: medium · CVSS 4 · Published 2026-02-05

FUXA is an open-source SCADA/HMI visualization platform commonly used to monitor and control industrial control systems. An unauthenticated attacker can bypass all authentication mechanisms on FUXA instances with security enabled, obtain administrator privileges, and execute arbitrary code on the server. This could lead to full system compromise and expose connected industrial environments to attack.

Technologies: [Frangoteam FUXA](https://junglewise.ai/threats/technologies/fuxa), [fuxa-server (npm)](https://junglewise.ai/threats/technologies/fuxa-server). Vendors: [Frangoteam](https://junglewise.ai/threats/vendors/frangoteam), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25893 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25893 being exploited in the wild.

**How severe is CVE-2026-25893?** Medium severity, with a CVSS score of 4, published 5 February 2026.

**Which products and versions are affected?** Frangoteam FUXA <= 1.2.9; fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.10.

**Is there a fix for CVE-2026-25893?** Yes. fuxa-server (npm): upgrade to 1.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25893 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25893?** Check whether you run Frangoteam FUXA or fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fuxa-server (npm): upgrade to 1.2.10 or later

  ```sh
  npm install fuxa-server@1.2.10
  ```


## Technical details

This vulnerability is an authentication bypass (CWE-287) that affects FUXA versions up to 1.2.9 when runtime.settings.secureEnabled is true. The flaw exists in the heartbeat refresh API endpoint, which does not properly validate authentication tokens and can be exploited by an unauthenticated remote attacker to mint administrator JWTs. No privileges, user interaction, or attack complexity are required. Once authenticated as admin, the attacker gains access to administrative APIs including automation and scripting features, allowing arbitrary code execution in the context of the FUXA service. The vulnerability is patched in version 1.2.10.

## Affected products

- frangoteam FUXA <= 1.2.9

## Identifiers

- CVE-2026-25893
- GHSA-vwcg-c828-9822

## Timeline

- 2026-02-05: disclosed
- 2026-02-05: patched: version 1.2.10

## References

- [https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822](https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822)

## Related threats

- [FUXA authorization bypass in /api/runscript](https://junglewise.ai/threats/cve-2026-42949-a-authorization-bypass-vulnerability-exists-in-the-api-runscript)
- [FUXA /nodered authorization bypass to RCE](https://junglewise.ai/threats/cve-2026-42922-a-authorization-bypass-vulnerability-exists-in-the-nodered)
- [FUXA information disclosure in Node-RED scripts endpoint](https://junglewise.ai/threats/cve-2026-40063-a-information-disclosure-vulnerability-exists-in-the-nodered-fuxa)
- [FUXA unauthenticated information disclosure in Socket.IO handlers](https://junglewise.ai/threats/cve-2026-67440-fuxa-unauthenticated-information-disclosure-in-socket-io-handlers)
- [Frangoteam FUXA privilege escalation in Scheduler API](https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api)