Weak Authentication in Termix Web-Based Server Management Platform

CVE-2026-45749

What is CVE-2026-45749?

Termix, a web-based server management platform, suffers from a security vulnerability that allows unauthorized access to critical functions involving Multi-Factor Authentication (MFA). Specifically, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints in versions prior to 2.3.2 improperly use the account password as the only authentication factor for sensitive MFA operations. This flaw enables an attacker who has compromised a user's password via phishing or other means to disable Time-based One-Time Passwords (TOTP) or regenerate backup codes, effectively negating the protections that MFA is designed to provide. Update to version 2.3.2 to mitigate this vulnerability.

References