CVE-2026-120200 Details
Description
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
A missing authorization vulnerability has been identified in Nexterm versions 1.0.6-OPEN-PREVIEW through 1.2.2-BETA. This vulnerability allows authenticated users to hibernate, resume, or terminate other users' remote sessions via the session lifecycle routes. The issue arises because the session management endpoints do not validate whether the user requesting the action actually owns the session. As a result, an attacker with knowledge of a session ID can disrupt active SSH, RDP, VNC, or SFTP sessions. This vulnerability is particularly concerning as session IDs can be accessed by users with the 'org.sessions.view' permission, including those with read-only access who could potentially terminate sessions.
Users can update to Nexterm version 1.2.2-BETA or later, where this vulnerability has been addressed. Instructions for updating can be found in the Nexterm documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gnmyt/Nexterm | [email protected] | Vendor |
| https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87 | [email protected] | Source CodeVendor |
| https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 | [email protected] | Source CodeVendor |
| https://github.com/gnmyt/Nexterm/issues/1944 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/gnmyt/Nexterm/pull/1950 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nexterm | >= 1.0.6-OPEN-PREVIEW, <= 1.2.2-BETA (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |