Description
FUXA <= 1.2.7 版本存在一个严重的安全漏洞，源于 /server/api/jwt-helper.js 文件中使用了硬编码的 JWT 密钥。远程攻击者可以利用此硬编码密钥伪造任意有效的管理员身份令牌，从而完全绕过身份验证机制，未经授权访问系统
FUXA /api/project 权限绕过漏洞（CVE-2025-69971）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/advisories/GHSA-2r8f-cf6w-x5vq
https://nvd.nist.gov/vuln/detail/CVE-2025-69971
https://www.cve.org/CVERecord?id=CVE-2025-69971
https://access.redhat.com/security/cve/cve-2025-69971
https://security.snyk.io/vuln/SNYK-JS-FUXASERVER-15219140
https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2025/CVE-2025-69971.yaml
https://www.sentinelone.com/vulnerability-database/cve-2025-69971/
https://www.momosec.cn/vulnerability