CVE-2026-65984

Received Received - Intake

Authentication Bypass via Stale JWT in FUXA

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-65984

EUVD

EUVD-2026-61213

Affected Vendors & Products

Vendor	Product	Version / Range
fuxa	process_visualization	to 1.3.3 (exc)
fuxa	process_visualization	1.3.3
frangoteam	fuxa	From 1.3.3 (inc)
frangoteam	fuxa	to 1.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability in FUXA versions 1.3.2 and earlier allows attackers with a previously issued privileged refresh cookie or access token to continue creating new privileged JWTs even after an account is deleted, disabled, or demoted. The issue stems from flawed token refresh and heartbeat endpoints that reuse stale user data or group claims without validating current user state.

Impact Analysis

An attacker could maintain unauthorized access to sensitive functions like user management, project manipulation, runtime configuration changes, script execution, and even create backdoor accounts. The vulnerability allows indefinite session persistence through continued refresh-cookie rotation.

Mitigation Strategies

Upgrade FUXA to version 1.3.3 or later to address the JWT lifecycle flaws and session persistence issues. Review and revoke all active sessions, especially privileged ones, after upgrading. Ensure secureEnabled=true is enabled to enforce proper authorization checks.

Hi! I’m here to help you understand CVE-2026-65984. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70