---
id: CVE-2026-79762
title: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities
summary: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys
  that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default
  …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-321
vendor: Termix-SSH
product: Termix
affected:
  - 'Termix >= 1.7.0, < 2.5.1'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T17:17:06.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79762'
references:
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/pull/1067'
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.906Z'
---

## Overview

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.