CVE-2026-79763 in Termix
Summary
by MITRE • 09/24/2026
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totp_code as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
Termix operates as a web-based server management platform providing essential administrative capabilities such as SSH terminal access, network tunneling, and file editing services. Within this ecosystem, security mechanisms are critical for protecting sensitive infrastructure configurations and credentials. A significant regression was introduced in version 2.4.0 that compromised the integrity of two-factor authentication (2FA) enforcement during specific account management operations. This flaw persisted through versions up to 2.5.1 before being addressed in subsequent releases. The vulnerability specifically affects endpoints responsible for managing Time-based One-Time Passwords, namely POST /users/totp/disable and POST /users/totp/backup-codes. These endpoints are designed to allow users to deactivate their TOTP configuration or regenerate backup codes, actions that inherently require strong re-authentication to prevent unauthorized account takeover or security degradation.
The technical root cause of this vulnerability lies in the implementation of the verifyTotpReauth function within the backend database routes for user TOTP management. Following a code refactor in version 2.4.0, the logic governing credential validation was altered such that it accepts either the user's account password or a valid TOTP code as sufficient proof of identity. This design choice treats these two distinct authentication factors as interchangeable credentials rather than requiring both or enforcing the presence of the second factor when one is already configured. Consequently, if an attacker possesses a victim's authenticated session cookie and also knows their plaintext password, they can bypass the intended multi-factor requirement entirely. The system validates the password via bcrypt comparison and grants access to disable TOTP settings without ever prompting for or verifying a time-based code from an authenticator device.
The operational impact of this flaw is severe, as it effectively downgrades the security posture of affected accounts from two-factor authentication back to single-factor authentication. By disabling TOTP through this vulnerability, an attacker removes the primary defense layer against credential stuffing and password spraying attacks. Furthermore, the ability to regenerate backup codes allows an attacker to invalidate existing recovery mechanisms and establish new ones under their control, ensuring persistent access even if the victim changes their password later. This scenario is particularly dangerous in environments where Termix manages critical servers, as it facilitates lateral movement and unauthorized administrative actions without triggering standard security alerts associated with missing second factors. The vulnerability aligns with CWE-287, which describes Improper Authentication, specifically illustrating a failure to enforce multi-factor authentication requirements during sensitive state changes.
From an adversary perspective, this flaw maps directly to ATT&CK technique T1078, Valid Accounts, as it allows the use of legitimate credentials to maintain access while bypassing additional security controls. It also relates to CWE-345, Insufficient Verification of Data Authenticity, in the context that the system fails to verify the authenticity of the second factor when required by policy. Mitigation strategies primarily involve upgrading Termix to version 2.5.1 or later, where this regression has been corrected and proper multi-factor enforcement is restored. For organizations unable to immediately patch, implementing a Web Application Firewall rule to block requests to these specific endpoints during maintenance windows can provide temporary relief. Additionally, enforcing strict session timeout policies and monitoring for unusual patterns in TOTP configuration changes can help detect exploitation attempts before significant damage occurs.