Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
CVE-2026-45749

8.1HIGH

Key Information:

Vendor

Termix-ssh

Status
Termix
Vendor
CVE Published:
5 June 2026

What is CVE-2026-45749?

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /users/totp/disable and POST /users/totp/backup-codes endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.

Affected Version(s)

Termix < 2.3.2

References

https://github.com/Termix-SSH/Termix/security/advisories/...
x_refsource_CONFIRM
https://github.com/Termix-SSH/Termix/releases/tag/release...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.