FUXA versions prior to 1.3.0 used a hardcoded fallback JWT signing secret ('frangoteam751') if no custom secret was configured. This allowed attackers who knew the default secret to forge valid JWT tokens and bypass authentication. The issue was fixed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided.