---
id: CVE-2026-79763
title: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities
summary: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities. From 2.4.0 until 2.5.1, the POST
  /users/totp/disable and POST /users/totp/backup-codes endpoints accept the
  account password as…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-308
vendor: Termix-SSH
product: Termix
affected:
  - 'Termix >= 2.4.0, < 2.5.1'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T19:39:45.600'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79763'
references:
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/22124e1bc49c8cedad57b31de9c51ad39f3d4432
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/pull/1067'
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T17:08:38.740425Z'
ingestedAt: '2026-09-24T16:47:15.858Z'
epss: 0.00315
epssPercentile: 0.21766
---

## Overview

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totp_code as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.