Termix EUVD-2026-86120

Exploitation requires the Termix account to have TOTP two-factor authentication enabled (versions 2.4.0 through pre-2.5.1) and the attacker to hold BOTH (1) the victim's already-authenticated session and (2) knowledge of the victim's account password. The attacker then calls POST /users/totp/disable or POST /users/totp/backup-codes supplying only the password, which verifyTotpReauth wrongly accepts as an interchangeable reauthentication credential. Limiting factors: the attacker cannot proceed without an active session (PR:L) and must separately know the plaintext password (contributing to AC:H); OIDC-authenticated accounts follow a different path; and the outcome is limited to degrading the account to single-factor auth rather than direct data access - no confidentiality or availability impact. The flaw is a regression of the fix for CVE-2026-45749.

This is a genuine but conditional security-degradation flaw, not a high-urgency issue. The CVSS 3.1 base score is 5.3 (medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - note the I:H is the sole driver, reflecting that the flaw undermines the account's second-factor integrity rather than exposing or destroying data (C:N/A:N). Exploitation is gated by two independent prerequisites baked into the vector: PR:L (the attacker must already hold the victim's authenticated session) and AC:H (the attacker must additionally know the victim's account password). Because the attacker already possesses both a valid session and the password, the practical incremental gain is narrow - they downgrade the victim from two-factor to single-factor auth (disable TOTP or invalidate backup codes), which is a persistence/foothold-preservation move rather than an initial-access primitive. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' The one CWE-mapping and impact signal worth flagging: the input Tag 'Information Disclosure' contradicts the CVSS vector (C:N), since this is an authentication-weakening / 2FA-bypass regression (CWE-308), not a confidentiality issue. Overall this is a correctly-scored medium that should be patched but does not warrant emergency prioritization given the compound preconditions and absence of exploitation signals.

An attacker who has already compromised a victim's active Termix web session (e.g., via stolen session token or an unlocked workstation) and who also knows the victim's account password sends a POST to /users/totp/disable or /users/totp/backup-codes, supplying only the password. Because the post-2.4.0 refactor made verifyTotpReauth accept the password alone, the server disables TOTP or invalidates backup codes without a valid authenticator code, leaving the account protected by password only. No public exploit code was identified; exploitation is straightforward once the two preconditions (session plus password) are met.