EUVD-2026-61213Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector confirmed, but AC:H because exploitation requires prior possession of a valid privileged token; PR:H because the token must encode former high-privilege group membership.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.
AnalysisAI
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a previously issued privileged FUXA refresh cookie or access token - this is the essential prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.5 with vector AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L reflects a network-exploitable flaw requiring prior high-privilege access (PR:H) and a specific prerequisite - possession of a previously issued privileged token (AT:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FUXA v1.3.3, which resolves both the refresh fallback and heartbeat re-signing issues. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all FUXA 1.3.2 and earlier instances in your environment and audit accounts that have been terminated, disabled, or demoted in the past 90 days; immediately invalidate all existing tokens for those users by rotating session secrets or clearing token stores. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today