Termix-SSH Termix up to 2.3.1 /users/totp/disable single-factor authentication

Summaryinfo

A vulnerability marked as critical has been reported in Termix-SSH Termix up to 2.3.1. This affects an unknown part of the file /users/totp/disable. This manipulation causes use of single-factor authentication. This vulnerability appears as CVE-2026-45749. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Termix-SSH Termix up to 2.3.1. It has been declared as critical. Affected by this vulnerability is an unknown code of the file /users/totp/disable. The manipulation with an unknown input leads to a use of single-factor authentication vulnerability. The CWE definition for the vulnerability is CWE-308. The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-45749 since 05/13/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1111 for this issue.

Upgrading to version 2.3.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• SSH Server Software

Vendor

• Termix-SSH

Name

• Termix

Version

• 2.3.0
• 2.3.1

Website

• Product: https://github.com/Termix-SSH/Termix/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion