Authentication Bypass in FUXA API by FrangoTeam
CVE-2025-69985
Key Information:
- Vendor
FrangoTeam
- Status
- Vendor
- CVE Published:
- 24 February 2026
Badges
What is CVE-2025-69985?
The FUXA application prior to version 1.2.8 suffers from an Authentication Bypass vulnerability that permits remote code execution. This flaw resides in the server/api/jwt-helper.js middleware, where the system incorrectly trusts the HTTP 'Referer' header to validate internal requests. An attacker, without authentication, can exploit this by spoofing the Referer header to align with the server's host. Once successful, the attacker gains unauthorized access to the sensitive /api/runscript endpoint, enabling the execution of arbitrary Node.js code on the server.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.