Executive brief
Termix, a web-based server management platform, contains a security flaw that allows attackers to bypass two-factor authentication (2FA). If an attacker obtains a user's password, they can exploit a weakness in how the system handles temporary login tokens to generate new backup codes and gain full access to the account. This effectively reduces the security of the platform to a single password, potentially exposing sensitive server management tools and data.
Technical details
An authentication bypass vulnerability exists in Termix prior to version 2.1.0 due to improper validation in the JWT authentication middleware. When a user logs in with a password, the `/users/login` endpoint issues a temporary token (`temp_token`) with a `pendingTOTP` state. However, the `auth-manager.ts` middleware fails to reject these tokens on standard authenticated routes. An attacker with valid password credentials can use this temporary token to access the `/users/totp/backup-codes` endpoint, generate new backup codes, and then use one of those codes to complete the `/users/totp/verify-login` flow. This allows the attacker to obtain a full session token and bypass the required TOTP authenticator app. The issue is fixed in version 2.1.0 by explicitly blocking `pendingTOTP` payloads in the authentication middleware.
Affected products
- Termix-SSH Termix < 2.1.0
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-04-22: patched: Version 2.1.0 released
- 2026-05-08: disclosed: CVE published to NVD