What is the CVSS score of EUVD-2026-34877?

EUVD-2026-34877 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2026-34877?

Within 24 hours: Identify all Termix instances in use and document their versions; alert security operations and SOC to monitor authentication logs for suspicious MFA modification attempts. Within 7 days: Implement Web Application Firewall rules restricting access to POST /users/totp/disable and POST /users/totp/backup-codes endpoints to administrative IP ranges only; enforce mandatory password resets for all users with forced MFA re-registration. Within 30 days: Establish regular vendor communication to obtain patch timeline and version number; prepare deployment infrastructure for upgrade once the patched version is released; evaluate alternative authentication products if vendor timeline becomes unacceptable.

Termix EUVD-2026-34877

Q: Which versions of Termix are affected by EUVD-2026-34877?

Termix versions prior to 2.3.2 contain an authentication control flaw enabling attackers who possess a user's password to completely disable or bypass multi-factor authentication protections,…. A patch is available.

| CVE-2026-45749 HIGH

Use of Single-factor Authentication (CWE-308)

2026-06-05 GitHub_M

Information Disclosure Termix Termix Ssh

8.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain victim password via phishing or hash leak
Delivery

Authenticate to Termix web UI
Exploit

POST /users/totp/disable or /users/totp/backup-codes
Install

Server accepts password-only check
C2

MFA disabled or backup codes rotated
Execute

Log in as victim bypassing 2FA
Impact

Pivot to managed SSH hosts and tunnels

Vulnerability Assessment

Weakness	CWE CWE-308 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Multi-factor authentication
Exploitation Conditions	The attacker must already possess the victim's Termix account password (via phishing, credential stuffing, or the related passwordHash leak cited in the advisory as GHSA-xxxx) and must reach a Termix instance prior to version 2.3.2 over the network - no TOTP code, backup code, or possession of the second-factor device is required. Exploitation is limited to accounts that have TOTP enabled (otherwise there is nothing to disable), requires network reachability of the Termix HTTP API on the targeted instance, and does not require user interaction or administrative privileges beyond the victim's own account; instances behind a VPN, SSO front-end, or IP allowlist correspondingly narrow the attack surface.
Impact	The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a network-reachable, low-complexity attack requiring only low privileges (an existing authenticated session via stolen password) with high confidentiality and integrity impact and no user interaction - a realistic profile for a post-credential-compromise scenario. No EPSS score, KEV listing, or public POC was provided, so this is best characterized as a high-severity logic flaw that becomes critical the moment a password leak occurs, rather than a wormable internet-scale issue. The CVE description explicitly references a separate passwordHash leak advisory (GHSA-xxxx, identifier truncated in input - verify exact ID), which materially raises real-world risk for any deployment that has not rotated credentials since that prior disclosure; absent that chain, exploitability depends on the attacker's success at credential phishing or stuffing against Termix users.
Exploit ScenarioDerived	An attacker phishes or credential-stuffs a Termix user's password, or reuses a hash recovered from the related passwordHash leak referenced in the advisory, and logs into the web UI. They then issue a POST /users/totp/disable request (authenticated only by that password) to switch off TOTP, or POST /users/totp/backup-codes to mint fresh recovery codes, and from there log in cleanly as the victim to pivot into managed SSH hosts, tunnels, and stored credentials. No public POC was provided, but the request shape is documented in the advisory and trivial to reproduce.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Vendor-released patch: upgrade to Termix 2.3.2 or later, available at https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag, which corrects the authentication policy on POST /users/totp/disable and POST /users/totp/backup-codes. Because the description references a related passwordHash leak (GHSA-xxxx), operators should also force a password reset for all users and invalidate existing sessions after upgrading, and review TOTP status for any account whose 2FA may have been silently disabled by an attacker. If immediate patching is not possible, restrict network exposure of the Termix web UI (block /users/totp/* paths at a reverse proxy or WAF and require VPN/SSO front-ending), accepting the trade-off that legitimate users will lose the ability to manage their own TOTP until access is restored; details and any further workarounds are tracked in the vendor advisory at https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m.

Affected VersionsENISA

Termix < 2.3.2

Affected Packages

euvd termix fix: 2.3.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Termix is an Electron/web-based SSH server management platform (CPE cpe:2.3:a:termix-ssh:termix) offering terminal access, tunneling, and file editing across Windows, Linux, and macOS. The root cause maps to CWE-308 (Use of Single-Factor Authentication): two endpoints that govern the state of the second authentication factor - disabling TOTP and rotating backup codes - re-use the primary password as their only proof of identity. Properly designed MFA flows for these step-down operations require a fresh TOTP code, a recovery code, or a re-authentication ceremony binding both factors, so that compromise of the password alone cannot collapse the security model back to single-factor.

Know when Termix gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /users/totp/disable and POST /users/totp/backup-codes endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.

Executive ViewAI

Why It Matters

Termix versions prior to 2.3.2 contain an authentication control flaw enabling attackers who possess a user's password to completely disable or bypass multi-factor authentication protections, transforming password compromises into direct account takeovers. For security-conscious organizations that have deployed MFA as a key control against credential-based attacks, this vulnerability effectively nullifies that investment across affected systems. With no public exploit identified at time of analysis but no vendor patch currently available, immediate interim controls are critical to prevent exploitation.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) WAF-based access controls limiting MFA management endpoints to administrative networks, (2) mandatory password reset cycles with forced MFA re-enrollment, (3) enhanced logging and alerting on MFA settings modifications, (4) rate limiting on authentication endpoints to impede credential stuffing attacks, (5) consideration of supplemental authentication mechanisms pending patch availability.

Threat Intelligence Overview

EPSS Score

0.1%

Top 82% exploitable

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.