An insecure default configuration in FUXA hardcodes a JSON Web Token (JWT) secret when authentication is enabled but no secret is supplied. This allows an unauthenticated attacker to forge token credentials and impersonate an administrator, leading to arbitrary code execution on the server. The flaw falls under CWE‑1188 (Generating Cryptographically Strong Secrets Using Weak or Unsuitable Keys) and CWE‑321 (Use of Hard‑coded Cryptographic Key). The impact is complete loss of confidentiality, integrity, and availability of the affected system.

The issue affects FUXA Process Visualization software by Frangoteam. Installations using the default configuration on any version up to and including 1.2.9 are vulnerable. The vulnerability is fixed in version 1.2.10, which requires the administrator to configure a custom JWT secret.

The CVSS score of 9.5 indicates a critical severity, although the EPSS score of less than 1% indicates the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and unauthenticated; an attacker can send crafted requests to the FUXA application over the network to exploit the hardcoded secret and gain administrative access.