CVE-2025-69985
criticalpriority · track · 12OT risk · elevatedEPSS 0.060 · 93 %ileexploit · PoCEUUSEPSS · scored 2026-10-27
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (3)
Public proof-of-concept and weaponised exploit code.
- EDB-52544FUXA 1.2.8 - Authentication Bypass + RCE ExploitPoC · exploit_db
- kaleth4/CVE-2025-69985kaleth4/CVE-2025-69985PoC · poc_in_github
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-4r4r-4jp4-wwf9FUXA has JWT Authentication Bypass via HTTP Referer header spoofing2026-02-24ghsa · osvUS
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40cnnvd
- https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.jscnnvd
- https://github.com/frangoteam/FUXA/releasesPatchcnnvd
- https://www.exploit-db.com/exploits/52544cnnvd
- https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40enisa_euvd
- https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.jsenisa_euvd
- https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40ExploitThird Party Advisorynvd
- https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.jsProductnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan