Termix CVE-2026-42452

Exploitation requires a TOTP-enabled Termix account plus knowledge of that account's password: the attacker authenticates the first factor at /users/login to obtain the temp_token JWT, then replays it against regular authenticated endpoints instead of completing the TOTP step. What limits exploitation is that the flaw does not bypass the password - an attacker with no valid credentials gains nothing - and it only affects accounts on which TOTP 2FA is actually enabled, on Termix versions prior to 2.1.0. No TOTP code, user interaction, or non-default configuration is needed beyond having 2FA turned on.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects a network-reachable, low-complexity attack requiring some privilege (PR:L - the attacker must possess the account password to obtain the temp_token) with high confidentiality and integrity impact and no availability impact. SSVC aligns on Technical Impact: total (full account/session control) but rates Automatable: no, consistent with the very low EPSS score (0.01%, 1st percentile) and the fact that the attacker still needs valid stolen/guessed credentials, making this a targeted rather than mass-exploitable issue. Signals are internally consistent: this is a genuine 2FA-defeating flaw with a public PoC, but not KEV-listed and not wormable - real priority for organizations relying on Termix TOTP as a compensating control (e.g., against password reuse or phishing), lower urgency where passwords are strong and unique. The key caveat is scope: the vulnerability only matters once the first factor (password) is already compromised, so it degrades defense-in-depth rather than granting unauthenticated access.

An attacker who has obtained a Termix user's password (via phishing, reuse, or a prior breach) submits it to /users/login and receives the temporary pendingTOTP JWT that is meant only to gate the TOTP prompt. Instead of completing the second-factor step, the attacker presents this temp_token directly to a protected API endpoint, which the auth middleware accepts, granting full authenticated access to the victim's SSH sessions, tunnels, and files without ever supplying the TOTP code. Public exploit code exists, and the low attack complexity makes this trivial to reproduce once a password is known.