CVE-2026-42452 Details
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.
A vulnerability in Termix, a web-based server management platform, allows for the bypass of two-factor authentication (2FA) for TOTP-enabled accounts. Prior to version 2.1.0, the login endpoint issued a temporary JWT (temp_token) that included a pendingTOTP state, intended only for second-factor authentication. However, this token was accepted on regular authenticated endpoints, effectively reducing 2FA to single-factor authentication for affected accounts. Exploitation of this vulnerability could lead to unauthorized access to accounts and their associated API privileges.
Users can update to Termix version 2.1.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag | [email protected] | Release NotesVendor |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-304 | Missing Critical Step in Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Termix | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |