# CVE-2026-65984: FUXA session fixation via stale JWT refresh

Source: https://junglewise.ai/threats/cve-2026-65984-fuxa-session-fixation-via-stale-jwt-refresh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65984 · Severity: info · CVSS 7.5 · Published 2026-08-18

FUXA is web-based SCADA/HMI software used to visualize and control industrial processes. In versions 1.3.2 and earlier, an attacker with a previously issued privileged access token can continue to mint new valid authentication tokens even after their account is deleted, disabled, or demoted. This allows indefinite unauthorized access to system administration functions including user management, project configuration, script execution, and backdoor account creation.

## Quick answers

**Is CVE-2026-65984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65984 being exploited in the wild.

**How severe is CVE-2026-65984?** Informational severity, with a CVSS score of 7.5, published 18 August 2026.

**Which products and versions are affected?** FUXA Team FUXA 1.3.2 and earlier.

**Is there a fix for CVE-2026-65984?** A patch was published on 2026-05-25: Fixed in version 1.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65984 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-65984?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in POST /api/refresh and POST /api/heartbeat endpoints where JWT token validation and refresh operations fail to verify the current state of the user account against the database. The refresh endpoint falls back to stale group claims from previously issued tokens even when the user record no longer exists or roles have been revoked. The heartbeat endpoint re-signs JWT claims without validating the current user record state. An attacker in possession of a valid refresh token or access token can exploit this to mint new privileged JWTs indefinitely, bypassing access control enforcement. No special authentication or user interaction is required beyond possessing a valid token. The fix is available in version 1.3.3.

## Affected products

- FUXA Team FUXA 1.3.2 and earlier

## Timeline

- 2026-08-18: disclosed
- 2026-05-25: patched: Fixed in version 1.3.3

## References

- [https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b](https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b)
- [https://github.com/frangoteam/FUXA/pull/2379](https://github.com/frangoteam/FUXA/pull/2379)