CVE-2026-65984
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
FUXA version 1.3.2 and earlier improperly handled session refresh, allowing an attacker with a previously issued privileged refresh cookie or access token to continue minting privileged JWTs even after account deletion, disablement, role removal, or demotion. This enabled continued unauthorized access to user management, project manipulation, runtime configuration, and backdoor-account creation. The issue is fixed in version 1.3.3.
Risk Assessment
The risk includes maintaining unauthorized access to the system, potentially leading to full control of the SCADA/HMI system, configuration changes, or creation of backdoor accounts.
Recommendation
Upgrade FUXA to version 1.3.3 or later and invalidate all existing sessions and tokens. Also review user accounts for unauthorized changes.
Original NVD description (English source)
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.