CVE-2026-79763: Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totpcode as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs both an authenticated session for the victim's account and knowledge of that account's password. They do not need the victim's authenticator or a valid TOTP code.
What actions can an attacker perform after exploiting it?
They can disable TOTP for the account or regenerate its backup codes, invalidating the existing codes. This weakens the account from two-factor to single-factor authentication.
Which versions should be remediated?
The issue affects Termix versions from 2.4.0 until the fix in version 2.5.1. Upgrade to version 2.5.1.