# CVE-2026-79763: Termix two-factor authentication bypass in TOTP disable endpoints

Source: https://junglewise.ai/threats/cve-2026-79763-termix-is-a-web-based-server-management-platform-with-ssh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79763 · Severity: medium · CVSS 5.3 · Published 2026-09-24

Termix is a web-based server management platform that provides SSH terminal access and file editing capabilities. A vulnerability in versions 2.4.0 through 2.5.1 allows attackers with an authenticated session and knowledge of the victim's password to disable two-factor authentication (TOTP) without providing a valid second factor, reducing the account to single-factor authentication and enabling account takeover.

Technologies: [Termix-SSH Termix](https://junglewise.ai/threats/technologies/termix). Vendors: [Termix-SSH](https://junglewise.ai/threats/vendors/termix-ssh).

## Quick answers

**Is CVE-2026-79763 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79763 being exploited in the wild.

**How severe is CVE-2026-79763?** Medium severity, with a CVSS score of 5.3, published 24 September 2026.

**Which products and versions are affected?** Termix-SSH Termix 2.4.0 through 2.5.1.

**Is there a fix for CVE-2026-79763?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79763 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79763?** Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The POST /users/totp/disable and POST /users/totp/backup-codes endpoints in src/backend/database/routes/user-totp-routes.ts treat password and TOTP code as interchangeable reauthentication factors due to a regression in version 2.4.0. An attacker with a valid authenticated session and the account password can bypass TOTP verification by calling verifyTotpReauth, which accepts the password alone and disables two-factor authentication. The vulnerability requires prior session compromise or password knowledge but no active authenticator device.

## Affected products

- Termix-SSH Termix 2.4.0 through 2.5.1

## Timeline

- 2026-09-24: disclosed: CVE-2026-79763 published

## References

- [https://github.com/Termix-SSH/Termix/commit/22124e1bc49c8cedad57b31de9c51ad39f3d4432](https://github.com/Termix-SSH/Termix/commit/22124e1bc49c8cedad57b31de9c51ad39f3d4432)
- [https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e](https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e)

## Related threats

- [Termix file-manager path traversal in transferToHost](https://junglewise.ai/threats/cve-2026-120322-a-vulnerability-was-identified-in-termix-ssh-termix-up-to-2-9-2)
- [Termix command injection in ACME SSL settings](https://junglewise.ai/threats/cve-2026-79766-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix server management platform SSRF via proxy endpoint](https://junglewise.ai/threats/cve-2026-79764-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix weak key derivation in OIDC and WebAuthn user encryption](https://junglewise.ai/threats/cve-2026-79762-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix SSH key deployment command injection](https://junglewise.ai/threats/cve-2026-79761-termix-is-a-web-based-server-management-platform-with-ssh)