[@frangoteam/fuxa] FUXA has a hardcoded fallback JWT signing secret

**[@frangoteam/fuxa] FUXA has a hardcoded fallback JWT signing secret**

FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured. If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication. This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided. References https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5 https://github.com/advisories/GHSA-c8m8-3jcr-6rj5

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.