Executive brief
FUXA is a web-based process visualization and industrial control software (SCADA/HMI/Dashboard). The application uses a hard-coded secret key to sign and verify user authentication tokens, allowing attackers to forge admin credentials and take complete control of the system without knowing legitimate login credentials. This could lead to unauthorized access to industrial processes, data manipulation, or system shutdown.
Technical details
The vulnerability is a hard-coded credential issue (CWE-798) in the JWT token handling mechanism. The application stores a static secret key in server/api/jwt-helper.js and uses it to sign and verify JWT tokens for authentication. Since the secret is not dynamically generated or externally managed, an attacker with knowledge of the hard-coded key can forge valid JWT tokens with arbitrary claims, including admin group membership. The attack requires network access to the FUXA server and no authentication, allowing remote exploitation. The vulnerable code initializes the secretCode variable with either a provided value or a generated fallback, but the hard-coded nature of this value is the core issue. All versions up to and including v1.2.7 are affected.
Affected products
- FUXA fuxa-server 0 through 1.2.7
Timeline
- 2026-02-03: disclosed
- 2026-05-11: other: Advisory withdrawn as duplicate of GHSA-c8m8-3jcr-6rj5