A ready-made attack for a flaw in FUXA is now public
KROMSE explanation
FUXA has a security flaw (CVE-2025-69985). The official record says: FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running FUXA.
- Install the maker's update for FUXA as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
