CVE-2026-79763: Termix Authentication Bypass Vulnerability

CVE-2026-79763 Overview

CVE-2026-79763 is a broken authentication vulnerability in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing features. The flaw affects versions 2.4.0 through 2.5.0 and resides in the POST /users/totp/disable and POST /users/totp/backup-codes endpoints. A 2.4.0 refactor regressed the two-factor check previously introduced for CVE-2026-45749, allowing the account password to serve as the sole reauthentication factor. An attacker with a victim's authenticated session and knowledge of the password can disable TOTP or regenerate backup codes without presenting a valid second factor. The issue is fixed in version 2.5.1.

Critical Impact
An attacker holding a hijacked session and the account password can unilaterally downgrade the victim's account to single-factor authentication, defeating TOTP protection.

Affected Products

Termix 2.4.0
Termix versions after 2.4.0 and prior to 2.5.1
Fixed in Termix 2.5.1

Discovery Timeline

2026-09-24 - CVE-2026-79763 published to NVD
2026-09-24 - Last updated in NVD database
Fix released - Termix 2.5.1 published via Termix Release v2.5.1

Technical Details for CVE-2026-79763

Vulnerability Analysis

The vulnerability is a missing second authentication factor condition classified under [CWE-308]. The affected code lives in src/backend/database/routes/user-totp-routes.ts. The helper function verifyTotpReauth accepts a single credential string and returns success whenever bcrypt.compare validates it against the stored password hash. Each endpoint then passes either the password or the totp_code as an interchangeable credential. This makes the password alone sufficient to pass reauthentication for operations that are specifically designed to require a second factor.

The consequence is a step-down in account security posture rather than direct data exposure. An attacker who has already captured an authenticated session, such as through session theft or an unlocked workstation, can call the sensitive TOTP management endpoints and strip the account's second factor without ever possessing the authenticator device.

Root Cause

A refactor in version 2.4.0 regressed the two-factor enforcement that had been introduced to remediate CVE-2026-45749. The reauthentication helper was simplified to treat any valid credential as sufficient, collapsing distinct knowledge and possession factors into a single OR branch. TOTP state-changing endpoints must require the actual TOTP code, not an interchangeable credential.

Attack Vector

Exploitation requires network access to the Termix instance, an authenticated session for the victim account, and knowledge of the victim's password. The attacker issues a POST /users/totp/disable or POST /users/totp/backup-codes request supplying only the password. The server validates the password through bcrypt.compare and executes the sensitive action, disabling TOTP or regenerating and invalidating existing backup codes.

typescript

// Patch excerpt from src/backend/database/routes/user-totp-routes.ts
   credential: string,
   userDataKey?: Buffer | null,
 ): Promise<boolean> {
-  if (!userRecord.isOidc && userRecord.passwordHash) {
-    const passwordMatch = await bcrypt.compare(
-      credential,
-      userRecord.passwordHash,
-    );
-    if (passwordMatch) {
-      return true;
-    }
-  }
-
   if (userRecord.totpSecret) {
     const totpSecret = userDataKey
       ? LazyFieldEncryption.safeGetFieldValue(

Source: Termix Commit 22124e1b. The patch removes the password-match branch so that only valid TOTP material satisfies reauthentication.

Detection Methods for CVE-2026-79763

Indicators of Compromise

Successful POST /users/totp/disable requests immediately followed by TOTP configuration changes for accounts that previously had TOTP enabled.
POST /users/totp/backup-codes calls that regenerate backup codes outside of expected user-initiated maintenance windows.
Audit log entries showing TOTP state transitions without a corresponding TOTP code verification event.

Detection Strategies

Correlate authentication session metadata, such as source IP and user agent, with TOTP management actions to flag anomalous geolocation or device changes.
Alert when a single account disables TOTP and then performs privileged SSH, tunneling, or file editing actions within a short window.
Review Termix application logs for calls to verifyTotpReauth on versions 2.4.0 through 2.5.0 and treat them as potentially credential-only reauthentications.

Monitoring Recommendations

Capture and retain HTTP request logs for all /users/totp/* endpoints with full timestamps and source identifiers.
Monitor for sudden drops in the number of accounts with TOTP enabled on Termix instances.
Forward Termix audit events to a centralized log platform for cross-correlation with session, SSH, and host activity.

How to Mitigate CVE-2026-79763

Immediate Actions Required

Upgrade all Termix deployments to version 2.5.1 or later without delay.
Audit all user accounts for recent TOTP disable or backup code regeneration events during the affected version window.
Force password rotation for accounts whose TOTP state changed on vulnerable builds and require users to re-enroll TOTP.
Invalidate active sessions after upgrade to prevent attackers from leveraging previously stolen session tokens.

Patch Information

The fix is delivered in Termix 2.5.1. The relevant changes are tracked in Termix Pull Request #1067 and the code patch in Termix Commit 22124e1b. Full remediation details are documented in GitHub Security Advisory GHSA-x9h9-f7jc-8jwj.

Workarounds

Restrict network access to the Termix web interface to trusted administrators until the upgrade is applied.
Enforce stronger session controls, such as short session lifetimes and IP binding, to reduce the window for session reuse.
Require password resets and TOTP re-enrollment for any account suspected of session compromise.

bash

# Upgrade Termix to the fixed release
git fetch --tags
git checkout release-2.5.1-tag
docker compose pull
docker compose up -d