CVE-2026-45749: Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /users/totp/disable and POST /users/totp/backup-codes endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45749?
The severity of CVE-2026-45749 is classified as high with a score of 8.1.
How do I fix CVE-2026-45749?
To fix CVE-2026-45749, update Termix to version 2.3.2 or later.
What does CVE-2026-45749 affect?
CVE-2026-45749 affects the Termix web-based server management platform.
What is the exploit of CVE-2026-45749?
CVE-2026-45749 allows an attacker to disable two-factor authentication using only the account password.
What are the implications of CVE-2026-45749?
The implications of CVE-2026-45749 include potential unauthorized access to user accounts due to the bypassing of multi-factor authentication.