What is the CVSS score of CVE-2026-42452?

CVE-2026-42452 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Termix are affected by CVE-2026-42452?

Termix prior to version 2.1.0 contains an authentication bypass allowing attackers who know a user's password to disable TOTP two-factor authentication, collapsing accounts to single-factor…

How to fix or mitigate CVE-2026-42452?

Within 24 hours: inventory all Termix instances and identify those with TOTP-protected accounts to scope exposure. Within 7 days: monitor vendor advisories for Termix 2.1.0 release and prepare upgrade procedures. Within 30 days: deploy version 2.1.0 to all instances once released (prioritize production), validate TOTP functionality restoration, and audit SSH access logs for exploitation attempts prior to patching.

Termix CVE-2026-42452

HIGH

Missing Critical Step in Authentication (CWE-304)

2026-05-08 GitHub_M

Information Disclosure Termix Termix Ssh

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Attacker must know the account password to obtain the temp_token (PR:L), attack is network-borne and low-complexity, and account takeover yields high confidentiality and integrity impact with no direct availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 00:13 vuln.today

Analysis Generated

Jul 24, 2026 - 00:13 vuln.today

CVE Published

May 08, 2026 - 22:54 nvd

HIGH 8.1

DescriptionCVE.org

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.

AnalysisAI

Authentication bypass in Termix (self-hosted SSH web management platform) before version 2.1.0 lets an attacker who knows only a victim's password bypass TOTP two-factor authentication. The /users/login endpoint issues a temporary JWT (temp_token) carrying a pendingTOTP state that should only unlock the second-factor step, but the auth middleware wrongly accepts this token on fully authenticated endpoints, collapsing 2FA into single-factor password authentication for every TOTP-enabled account. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS probability is very low (0.01%, 1st percentile) and there is no evidence of active exploitation.

Technical ContextAI

Termix is a web-based server management platform providing SSH terminal, tunneling, and file-editing features, deployed as a self-hosted desktop/server application (cpe:2.3:a:termix-ssh:termix). The flaw is a token-state authorization failure rooted in CWE-304 (Missing Critical Step in Authentication). Termix's login flow implements 2FA by first validating the password and, for TOTP-enabled accounts, returning a short-lived temp_token JWT that encodes a pendingTOTP flag; the intended design is that this token only authorizes the TOTP-verification call and is exchanged for a full session token after the correct one-time code is submitted. Because the JWT-verifying auth middleware does not check the pendingTOTP claim, it treats the interim token as a valid session credential on regular protected endpoints, so the mandatory second-factor step is never enforced.

RemediationAI

Vendor-released patch: 2.1.0 - upgrade all Termix installations to release-2.1.0-tag (https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag), which corrects the auth middleware so temp_tokens carrying pendingTOTP are rejected on authenticated endpoints, per advisory GHSA-vx59-rf9w-9jv8 (https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8). Until the upgrade is applied, treat the password as the only effective factor: enforce strong, unique passwords and, where possible, restrict access to the Termix web interface behind a VPN or IP allowlist and place it behind a reverse proxy so the login/API endpoints are not directly internet-exposed - the trade-off is added network friction and no protection against an insider or an attacker who is already inside the trusted network. Consider forcing a credential/session reset after patching, since pre-patch sessions may have been established without a real second factor.