CVE-2026-42452

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.

• CWE-304

• https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8

Published

May 8, 2026

Last Modified

Jul 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42446NanaZip is an open source file archive. From 5.0.1252.0 to b…7.1
• CVE-2026-42447jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui i…5
• CVE-2026-42448Magic Wormhole makes it possible to get arbitrary-sized file…3.5
• CVE-2026-42449n8n-MCP is an MCP server that provides AI assistants access …8.5
• CVE-2026-42450OpenColorIO is a color management framework for visual effec…8.4
• CVE-2026-42451Grimmory is a self-hosted digital library. Prior to version …6.3
• CVE-2026-42453Termix is a web-based server management platform with SSH te…8.7
• CVE-2026-42454Termix is a web-based server management platform with SSH te…9.9
• CVE-2026-42455Linkwarden is a self-hosted, open-source collaborative bookm…8.8
• CVE-2026-42456AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-42457vCluster Platform provides a Kubernetes platform for managin…9
• CVE-2026-42458Magento Long Term Support (LTS) is an unofficial, community-…5.3