What is the CVSS score of EUVD-2026-34877?

EUVD-2026-34877 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Termix are affected by EUVD-2026-34877?

Termix versions prior to 2.3.2 contain an authentication control flaw enabling attackers who possess a user's password to completely disable or bypass multi-factor authentication protections,…. A patch is available.

How to fix or mitigate EUVD-2026-34877?

Within 24 hours: Identify all Termix instances in use and document their versions; alert security operations and SOC to monitor authentication logs for suspicious MFA modification attempts. Within 7 days: Implement Web Application Firewall rules restricting access to POST /users/totp/disable and POST /users/totp/backup-codes endpoints to administrative IP ranges only; enforce mandatory password resets for all users with forced MFA re-registration. Within 30 days: Establish regular vendor communication to obtain patch timeline and version number; prepare deployment infrastructure for upgrade once the patched version is released; evaluate alternative authentication products if vendor timeline becomes unacceptable.

Termix EUVD-2026-34877

| CVE-2026-45749 HIGH

Use of Single-factor Authentication (CWE-308)

2026-06-05 GitHub_M

Information Disclosure Termix

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 05, 2026 - 18:43 vuln.today

Analysis Generated

Jun 05, 2026 - 18:43 vuln.today

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /users/totp/disable and POST /users/totp/backup-codes endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.

AnalysisAI

Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Termix is an Electron/web-based SSH server management platform (CPE cpe:2.3:a:termix-ssh:termix) offering terminal access, tunneling, and file editing across Windows, Linux, and macOS. The root cause maps to CWE-308 (Use of Single-Factor Authentication): two endpoints that govern the state of the second authentication factor - disabling TOTP and rotating backup codes - re-use the primary password as their only proof of identity. Properly designed MFA flows for these step-down operations require a fresh TOTP code, a recovery code, or a re-authentication ceremony binding both factors, so that compromise of the password alone cannot collapse the security model back to single-factor.

RemediationAI

Vendor-released patch: upgrade to Termix 2.3.2 or later, available at https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag, which corrects the authentication policy on POST /users/totp/disable and POST /users/totp/backup-codes. Because the description references a related passwordHash leak (GHSA-xxxx), operators should also force a password reset for all users and invalidate existing sessions after upgrading, and review TOTP status for any account whose 2FA may have been silently disabled by an attacker. If immediate patching is not possible, restrict network exposure of the Termix web UI (block /users/totp/* paths at a reverse proxy or WAF and require VPN/SSO front-ending), accepting the trade-off that legitimate users will lose the ability to manage their own TOTP until access is restored; details and any further workarounds are tracked in the vendor advisory at https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m.