CVE-2026-79762: Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDCSYSTEMSECRET and WEBAUTHNSYSTEMSECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
Which users' credentials are exposed if the database is copied?
OIDC and WebAuthn users are affected because their data-encryption keys are wrapped using keys derived from committed default strings and their public user IDs. Password-authenticated users are not affected by this specific derivation path.
What does an attacker need to exploit this issue?
An attacker needs an offline copy of the SQLite database. They can then derive the wrapping keys, recover affected users' data-encryption keys, and decrypt stored SSH passwords, private keys, and key passphrases.
Are default deployments affected?
Yes. The project's default deployment artifacts do not configure OIDC_SYSTEM_SECRET or WEBAUTHN_SYSTEM_SECRET, causing the committed default strings to be used for the affected OIDC and WebAuthn paths.
Which versions should be remediated?
Termix versions from 1.7.0 until 2.5.1 are affected. The issue is fixed in version 2.5.1.