CVE-2026-42452: Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temptoken) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42452?
CVE-2026-42452 is classified as a high severity vulnerability due to its potential for unauthorized access and account takeover.
How do I fix CVE-2026-42452?
To fix CVE-2026-42452, upgrade to Termix version 2.1.0 or later which addresses this vulnerability.
What is affected by CVE-2026-42452?
CVE-2026-42452 affects all versions of Termix prior to 2.1.0, particularly impacting TOTP-enabled accounts.
What exploit risks are associated with CVE-2026-42452?
Exploitation of CVE-2026-42452 can allow an attacker to regenerate backup codes, compromising account security.
Is CVE-2026-42452 specific to certain configurations of Termix?
CVE-2026-42452 is generally applicable to any configuration of Termix that utilizes TOTP before version 2.1.0.