Sensitive information in source code In fuxa-server
Description
FUXA has a hardcoded fallback JWT signing secret
FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.
If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.
This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | - | ||
npm | 1.3.0 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4.