EUVD-2026-62857Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated JWT gives PR:L, IDOR needs no special conditions so AC:L, and plaintext credential disclosure enables full control of external managed hosts, justifying S:C with C:H/I:H and A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.
AnalysisAI
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated Termix session (JWT) - per CVSS PR:L this is an authenticated attack, so an attacker must be able to obtain an account, which is trivial on instances that permit self-registration and harder on locked-down single-tenant deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a paper-high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a low-privilege Termix account and authenticates to get a JWT. They script requests to GET /host/db/host/:id/password?field=password and ?field=sudoPassword while incrementing the numeric id, dumping other users' plaintext SSH and sudo passwords, then use those credentials to log directly into the managed servers and take control. … |
| Remediation | Upgrade to Termix 2.6.1, which enforces host ownership during credential resolution (Vendor-released patch: 2.6.1); the advisory is GHSA-j6h8-mww6-pgw6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Termix instances to identify version and user count; restrict network access to Termix to trusted IP ranges and enforce MFA for all accounts; review access logs for exploitation of the GET /host/db/host/:id/password endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Docker default credentials in Termix server management. PoC and patch available.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated lo
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an a
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-re
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today