Weakness in Termix Management Platform Allows Bypassing of Two-Factor Authentication

CVE-2026-42452

What is CVE-2026-42452?

The Termix Server Management Platform, which offers an array of web-based server management features, has a security issue where a temporary JSON Web Token (JWT) is generated for accounts using Time-based One-Time Password (TOTP) authentication. This token, meant to be transient and limited to the TOTP verification flow, is inadvertently accepted by the authentication middleware on regular endpoints. This could lead to a scenario where two-factor authentication is weakened, effectively allowing unauthorized access to accounts. This vulnerability has been patched in version 2.1.0, reinforcing the importance of updating to maintain robust security standards.

References