CVE-2026-25894

The vulnerability results from a combination of two errors: use of a hardcoded or empty JWT secret (CWE-321) and unsafe default configuration (CWE-1188). When an administrator enables authentication but does not configure their own JWT secret, the application uses a predictable default value. An attacker can exploit this knowledge to independently generate a valid JWT token with administrator privileges, without knowing any credentials. With an administrator token in possession, the attacker can then execute arbitrary code on the server hosting the FUXA application.

The attacker gains full administrative access to the SCADA/HMI system and the ability to remotely execute arbitrary code (RCE) on the server, which in industrial environments can lead to disruption or sabotage of technological processes.

FUXA should be updated to version 1.2.10, where the issue has been patched. The patch is available in the GitHub repository (commit ea7b3df066f9fdef8ecdce318398ae40546bc50d) and in the official v1.2.10 release. Until the update is applied, it is recommended to isolate the FUXA web interface from external networks and manually set a strong, random JWT secret in the application configuration.

Frangoteam FUXA in versions up to and including 1.2.9, when authentication is enabled but the administrator JWT secret has not been explicitly configured