CVE-2026-79763
Received Received - Intake

Authentication Bypass in Termix via Password Reuse

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totp_code as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79763
EUVD
EUVD-2026-86120

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
termix termix From 2.4.0 (inc) to 2.5.1 (inc)
termix termix 2.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-308 The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Termix, a web-based server management platform. Due to a regression in versions 2.4.0 to 2.5.1, two endpoints (POST /users/totp/disable and POST /users/totp/backup-codes) only require a user's password for reauthentication instead of requiring both the password and a second factor like TOTP. This allows attackers with a victim's authenticated session and knowledge of their password to disable TOTP or regenerate backup codes, reducing account security to single-factor authentication.

Detection Guidance

Check Termix server logs for POST requests to /users/totp/disable or /users/totp/backup-codes endpoints. Verify if these requests are authenticated with only a password and not a second factor. Ensure the server is running version 2.5.1 or later.

Impact Analysis

If you use Termix versions 2.4.0 to 2.5.1, an attacker who gains access to your authenticated session and knows your password could disable your two-factor authentication (TOTP) or regenerate backup codes. This would weaken your account security, allowing unauthorized access even if you had previously enabled stronger authentication methods.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by reducing account security to single-factor authentication. GDPR requires appropriate technical measures to protect personal data, while HIPAA mandates strong access controls. Weakening authentication may violate these requirements, potentially leading to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade Termix to version 2.5.1 or later. Review logs for suspicious POST requests to the affected endpoints. Enforce strict two-factor authentication policies for all user accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart