Is CVE-2026-79762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79762 being exploited in the wild.

How severe is CVE-2026-79762?

Medium severity, with a CVSS score of 5.5, published 24 September 2026.

Which products and versions are affected?

Termix-SSH Termix 1.7.0 through 2.5.0.

Is there a fix for CVE-2026-79762?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79762 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-79762?

Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79762: Termix weak key derivation in OIDC and WebAuthn user encryption

CVE-2026-79762 · Severity: medium · CVSS 5.5 · Published 2026-09-24

Termix is a web-based SSH terminal and server management platform. Versions 1.7.0 through 2.5.0 use hardcoded default values to derive encryption keys for users who authenticate via OIDC or WebAuthn. An attacker with offline access to the SQLite database can recover users' SSH passwords, private keys, and passphrases by deriving the weak encryption keys. Password-authenticated users are not affected.

Technologies: Termix-SSH Termix. Vendors: Termix-SSH.

Quick answers

Is CVE-2026-79762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79762 being exploited in the wild.
How severe is CVE-2026-79762?: Medium severity, with a CVSS score of 5.5, published 24 September 2026.
Which products and versions are affected?: Termix-SSH Termix 1.7.0 through 2.5.0.
Is there a fix for CVE-2026-79762?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79762 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-79762?: Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in src/backend/utils/user-crypto.ts where OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are derived from committed default strings and a public userId salt instead of being securely configured. An attacker with a copy of the SQLite database can perform offline key derivation to recover each affected user's Data Encryption Key (DEK), then decrypt stored SSH credentials. The fix in version 2.5.1 requires proper secret configuration.

Affected products

Termix-SSH Termix 1.7.0 through 2.5.0

Timeline

2026-09-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.