CVE-2026-42452

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-08 23:16

Updated : 2026-07-25 11:10

NVD link : CVE-2026-42452

Mitre link : CVE-2026-42452

CVE.ORG link : CVE-2026-42452

JSON object : View

Products Affected

No product.

CWE

CWE-304

Missing Critical Step in Authentication

{"id": "CVE-2026-42452", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42452", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T02:14:12.163245Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Termix-SSH", "product": "Termix", "versions": [{"status": "affected", "version": "< 2.1.0"}]}]}], "published": "2026-05-08T23:16:38.827", "references": [{"url": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag", "source": "security-advisories@github.com"}, {"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8", "source": "security-advisories@github.com"}, {"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-304"}]}], "descriptions": [{"lang": "en", "value": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0."}, {"lang": "es", "value": "Termix es una plataforma de gesti\u00f3n de servidores basada en web con capacidades de terminal SSH, tunelizaci\u00f3n y edici\u00f3n de archivos. Antes de la versi\u00f3n 2.1.0, /users/login emite un JWT temporal (temp_token) para cuentas con TOTP habilitado. Ese token lleva un estado pendingTOTP y solo deber\u00eda ser v\u00e1lido para el flujo del segundo factor. Sin embargo, el middleware de autenticaci\u00f3n acepta este token en puntos finales autenticados regulares. Esto convierte efectivamente la 2FA en un factor \u00fanico (contrase\u00f1a) para las cuentas afectadas. Este problema ha sido parcheado en la versi\u00f3n 2.1.0."}], "lastModified": "2026-07-25T11:10:00.100", "sourceIdentifier": "security-advisories@github.com"}