CVE-2026-120200 in Nexterm
Summary
by MITRE • 10/31/2026
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Nexterm versions through 1.2.2-BETA represents a critical failure in access control mechanisms within the application's session management subsystem. Specifically, this is classified as an insecure direct object reference (IDOR) combined with missing function-level authorization controls. The core technical flaw lies in the API endpoints responsible for managing remote desktop and terminal sessions, which fail to verify that the authenticated user initiating a request possesses administrative privileges or ownership rights over the target session. Consequently, any validly authenticated user can manipulate the state of other users' active connections by directly invoking specific HTTP methods against URLs containing arbitrary session identifiers. This lack of proper authorization checks allows for unauthorized interference with ongoing remote access activities, undermining the fundamental principle that only authorized administrators should have control over session lifecycle events such as suspension or termination.
From a technical perspective, the exploitation vector involves obtaining a valid session identifier associated with another user's active connection to services like SSH, RDP, VNC, or SFTP. Once this identifier is acquired, typically through session hijacking, predictable URL structures, or information leakage from other parts of the application interface, an attacker can send crafted requests to the hibernate, resume, or DELETE endpoints. The server processes these requests based solely on the presence of a valid authentication token for the requester and the syntactic validity of the session ID provided in the request body or path parameters. It does not cross-reference this information against access control lists or ownership records associated with that specific session resource. This architectural oversight enables an attacker to disrupt live sessions without needing elevated privileges, effectively bypassing intended security boundaries designed to protect user workflows and administrative controls.
The operational impact of this vulnerability is significant for organizations relying on Nexterm as a centralized gateway for remote administration. By terminating or hibernating other users' sessions, an attacker can cause immediate denial of service conditions that disrupt critical business operations dependent on continuous remote access. For instance, if an administrator's SSH session to a production server is forcibly terminated during a maintenance window, it could lead to incomplete configurations, data corruption, or extended downtime while the connection must be re-established and verified. Furthermore, the ability to resume sessions might allow for unauthorized persistence or manipulation of ongoing tasks if the resumed session retains elevated privileges that were not properly scoped to the attacker's identity. This capability also facilitates lateral movement within an internal network by disrupting security monitoring tools or incident response efforts that rely on persistent remote connections to investigate threats.
This vulnerability aligns with CWE-284, which describes improper access control where a user can act as another user due to insufficient authorization checks. In the context of the MITRE ATT&CK framework, this behavior maps directly to T1078 Valid Accounts and specifically relates to techniques involving session manipulation or hijacking. The attack pattern resembles aspects of T1534 Internal Spearphishing if used in conjunction with social engineering to obtain credentials, but more accurately reflects direct exploitation of API flaws similar to those described under resource manipulation tactics. Defenders should recognize that even authenticated users pose a risk when application logic fails to enforce strict separation between user roles and session ownership rights.
To mitigate this vulnerability, immediate action is required to upgrade Nexterm to a version later than 1.2.2-BETA where the authorization checks have been implemented correctly. Until an update is applied, administrators should implement network-level controls such as web application firewalls that restrict access to sensitive API endpoints based on IP reputation or known malicious patterns, although this is not a substitute for fixing the root cause. It is also advisable to enforce strict session management policies, including short-lived tokens and robust rotation mechanisms, to reduce the window of opportunity if an attacker manages to capture a valid session ID. Additionally, implementing comprehensive logging and monitoring for unusual API call frequencies or unauthorized attempts to access session lifecycle endpoints can help detect exploitation attempts in real-time. Regular security audits focusing on function-level authorization logic are essential to prevent similar flaws from persisting in future releases.