CVE-2026-79763 Details
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totp_code as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1.
A vulnerability in Termix versions 2.4.0 prior to 2.5.1 allows the account password to be used as the sole reauthentication factor for critical MFA operations, such as disabling two-factor authentication and regenerating TOTP backup codes. This issue arises from a regression of the two-factor check previously implemented to address CVE-2026-45749. The vulnerability is present in the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, where the password can be used interchangeably with TOTP codes as a credential. An attacker with knowledge of the password and access to the victim's authenticated session can exploit this vulnerability to weaken the account's security.
Users should update to Termix version 2.5.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Termix-SSH/Termix/commit/22124e1bc49c8cedad57b31de9c51ad39f3d4432 | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/pull/1067 | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag | [email protected] | Release NotesVendor |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-308 | Use of Single-factor Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Termix | >= 2.4.0, < 2.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |