# CVE-2026-42452: Termix-SSH Termix two-factor authentication bypass in auth middleware

Source: https://junglewise.ai/threats/cve-2026-42452-termix-ssh-termix-two-factor-authentication-bypass-in-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-42452 · Severity: high · CVSS 8.1 · Published 2026-05-08

Termix, a web-based server management platform, contains a security flaw that allows attackers to bypass two-factor authentication (2FA). If an attacker obtains a user's password, they can exploit a weakness in how the system handles temporary login tokens to generate new backup codes and gain full access to the account. This effectively reduces the security of the platform to a single password, potentially exposing sensitive server management tools and data.

Technologies: [Termix-SSH Termix](https://junglewise.ai/threats/technologies/termix). Vendors: [Termix-SSH](https://junglewise.ai/threats/vendors/termix-ssh).

## Quick answers

**Is CVE-2026-42452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42452 being exploited in the wild.

**How severe is CVE-2026-42452?** High severity, with a CVSS score of 8.1, published 8 May 2026.

**Which products and versions are affected?** Termix-SSH Termix < 2.1.0; Termix-SSH < 2.1.0.

**Is there a fix for CVE-2026-42452?** A patch was published on 2026-04-22: Version 2.1.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42452 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42452?** Check whether you run Termix-SSH Termix or Termix-SSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in Termix prior to version 2.1.0 due to improper validation in the JWT authentication middleware. When a user logs in with a password, the `/users/login` endpoint issues a temporary token (`temp_token`) with a `pendingTOTP` state. However, the `auth-manager.ts` middleware fails to reject these tokens on standard authenticated routes. An attacker with valid password credentials can use this temporary token to access the `/users/totp/backup-codes` endpoint, generate new backup codes, and then use one of those codes to complete the `/users/totp/verify-login` flow. This allows the attacker to obtain a full session token and bypass the required TOTP authenticator app. The issue is fixed in version 2.1.0 by explicitly blocking `pendingTOTP` payloads in the authentication middleware.

## Affected products

- Termix-SSH Termix < 2.1.0

## Timeline

- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-04-22: patched: Version 2.1.0 released
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag](https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag)
- [https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8](https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8)

## Related threats

- [Termix file-manager path traversal in transferToHost](https://junglewise.ai/threats/cve-2026-120322-a-vulnerability-was-identified-in-termix-ssh-termix-up-to-2-9-2)
- [Termix command injection in ACME SSL settings](https://junglewise.ai/threats/cve-2026-79766-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix server management platform SSRF via proxy endpoint](https://junglewise.ai/threats/cve-2026-79764-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix two-factor authentication bypass in TOTP disable endpoints](https://junglewise.ai/threats/cve-2026-79763-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix weak key derivation in OIDC and WebAuthn user encryption](https://junglewise.ai/threats/cve-2026-79762-termix-is-a-web-based-server-management-platform-with-ssh)