What is GHSA-c8m8-3jcr-6rj5?

GHSA-c8m8-3jcr-6rj5 is a security advisory published by GitHub Security Advisories with High severity. FUXA has a hardcoded fallback JWT signing secret

Which CVE IDs does GHSA-c8m8-3jcr-6rj5 cover?

GHSA-c8m8-3jcr-6rj5 covers the following CVE IDs: CVE-2025-69971. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c8m8-3jcr-6rj5?

GHSA-c8m8-3jcr-6rj5 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-c8m8-3jcr-6rj5?

GHSA-c8m8-3jcr-6rj5 affects 1 product, including: npm/@frangoteam/fuxa:\u003c= 1.2.11.

GHSA-c8m8-3jcr-6rj5HighCVSS 8.1

FUXA has a hardcoded fallback JWT signing secret

Vendor

GitHub Security Advisories

Published

March 7, 2026

Last Modified

May 11, 2026

🔗 CVE IDs covered (1)

CVE-2025-69971 →

📋 Description

FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.

If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.

This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided.

🎯 Affected products1

npm/@frangoteam/fuxa:<= 1.2.11

🔗 References (4)

https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5
https://nvd.nist.gov/vuln/detail/CVE-2025-69971
https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js
https://github.com/advisories/GHSA-c8m8-3jcr-6rj5