Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.
References
| Link | Resource |
|---|---|
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag | Product Release Notes |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m | Exploit Mitigation Vendor Advisory |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m | Exploit Mitigation Vendor Advisory |
Configurations
History
08 Jun 2026, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:* | |
| First Time |
Termix
Termix termix |
|
| References | () https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag - Product, Release Notes | |
| References | () https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m - Exploit, Mitigation, Vendor Advisory |
05 Jun 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m - |
05 Jun 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-05 18:17
Updated : 2026-06-08 14:59
NVD link : CVE-2026-45749
Mitre link : CVE-2026-45749
CVE.ORG link : CVE-2026-45749
JSON object : View
Products Affected
termix
- termix
CWE
CWE-308
Use of Single-factor Authentication