CVE-2026-79762
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79762
EUVD
EUVD-2026-86162

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
termix termix From 1.7.0 (inc) to 2.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Termix versions 1.7.0 to 2.5.0. It involves hardcoded default keys used to encrypt stored SSH credentials for users authenticated via OIDC or WebAuthn. The keys are derived from a constant string and a public userId salt, allowing attackers with an offline SQLite database copy to derive the encryption key and decrypt sensitive data like SSH passwords and private keys.

Impact Analysis

If you use Termix versions 1.7.0 to 2.5.0 with OIDC or WebAuthn authentication, an attacker who obtains a copy of your SQLite database could decrypt your stored SSH passwords, private keys, and key passphrases without needing server access or user interaction. This compromises the confidentiality of your credentials.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive personal data (SSH credentials) stored in encrypted form. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach of encrypted credentials may still violate these regulations if encryption keys are compromised.

Mitigation Strategies
  • Upgrade Termix to version 2.5.1 or later to address the hardcoded key issue.
  • Review and remove any default secrets in the configuration to prevent hardcoded key usage.
  • Migrate existing encrypted data to new keys derived from secure, configurable secrets.
  • Ensure OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are properly configured in your deployment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart