CVE-2026-75108: Next Terminal Auth Bypass Vulnerability

CVE-2026-75108 Overview

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints. Any authenticated user can call these endpoints with arbitrary asset identifiers to probe and wake assets they are not granted access to. Attackers can retrieve asset information including display names, reachability status, connection timing, and network addresses. The same endpoints allow attackers to trigger wake-on-LAN packets against unauthorized assets. This authorization flaw maps to CWE-862: Missing Authorization.

Critical Impact
Authenticated users can enumerate protected asset metadata and remotely power on hosts outside their authorization scope, expanding internal reconnaissance and lateral movement opportunities.

Affected Products

Next Terminal (remote access gateway)
Portal ping endpoint (per-asset authorization missing)
Portal wake-on-LAN endpoint (per-asset authorization missing)

Discovery Timeline

2026-08-17 - CVE-2026-75108 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75108

Vulnerability Analysis

Next Terminal is a bastion-style remote access gateway that brokers connections to internal assets. The portal exposes helper endpoints that let users check whether an asset is reachable (ping) and send wake-on-LAN (WoL) magic packets to power on assets. These endpoints require authentication but do not verify that the calling user is entitled to access the specific asset identifier supplied in the request.

Because the authorization decision stops at authentication, a low-privileged user can substitute arbitrary asset IDs and receive server-side responses generated against assets in another user's scope. The ping endpoint returns display name, reachability, connection timing, and network address data. The wake-on-LAN endpoint emits a broadcast frame carrying the target MAC address.

The practical outcome is an information disclosure primitive combined with a limited action primitive. An attacker learns which internal hosts exist, whether they are online, and their addresses, then selectively powers on dormant hosts to broaden the attack surface.

Root Cause

The endpoints implement a global authentication filter but omit per-object authorization. The handlers accept an assetId parameter from the request and dispatch backend actions without consulting the access control list that governs which assets the session principal may view or operate. This is a classic missing function-level authorization pattern.

Attack Vector

Exploitation requires network reachability to the Next Terminal portal and valid credentials for any user account. The attacker iterates asset identifiers against the ping endpoint to enumerate reachable assets and their addresses. The attacker then invokes the wake-on-LAN endpoint with any enumerated identifier to emit magic packets on the segment where the Next Terminal server can broadcast.

// Vulnerability described in prose; no verified public exploit code is available.
// See VulnCheck advisory and GitHub Issue #573 for technical details.

Detection Methods for CVE-2026-75108

Indicators of Compromise

Repeated authenticated requests to the portal ping endpoint from a single session iterating sequential or enumerated assetId values.
Portal wake-on-LAN requests targeting asset identifiers that the calling user has no historical connection sessions against.
Unexpected wake-on-LAN magic packets originating from the Next Terminal host to internal broadcast addresses.

Detection Strategies

Correlate portal access logs with the asset ACL to flag requests where the requesting user is not authorized for the referenced assetId.
Baseline the ratio of ping and WoL calls per user, and alert on volumetric spikes consistent with enumeration.
Alert on WoL packets sent to MAC addresses not associated with the requester's authorized asset set.

Monitoring Recommendations

Ingest Next Terminal application logs into a centralized logging platform and retain request-level fields including user, endpoint, and assetId.
Monitor authentication events for accounts that suddenly probe large asset ID ranges after login.
Track network telemetry for wake-on-LAN broadcast traffic originating from the gateway outside change windows.

How to Mitigate CVE-2026-75108

Immediate Actions Required

Upgrade Next Terminal to a release that enforces per-asset authorization on the ping and wake-on-LAN endpoints once available from the maintainers.
Restrict portal access to trusted networks and require multi-factor authentication for all portal accounts.
Audit existing user accounts and remove stale or over-provisioned identities that could be used to enumerate assets.

Patch Information

Refer to the Next Terminal GitHub repository and GitHub Issue #573 for the current remediation status. The VulnCheck advisory tracks additional details on affected versions and fixes.

Workarounds

Place a reverse proxy in front of Next Terminal and block or rate-limit the ping and wake-on-LAN portal routes for non-administrative users.
Disable wake-on-LAN functionality at the gateway configuration level if it is not required in the environment.
Segment the Next Terminal host so it cannot broadcast wake-on-LAN packets into sensitive network zones.

bash

# Example: block portal ping and WoL endpoints at an nginx reverse proxy
# Replace paths with the routes used by your Next Terminal deployment.
location ~ ^/api/(assets/.+/ping|wol) {
    deny all;
    return 403;
}