{"cvss":0.0,"datePublished":"2026-04-24T00:00:00Z","dateUpdated":"2026-04-24T00:00:00Z","description":"FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP \"Referer\" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.","dueDate":"","id":"CVE-2025-69985","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"fuxa","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"frangoteam fuxa Authentication Bypass Using an Alternate Path or Channel","vendor":"frangoteam"}