CVE-2026-45749

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2

Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The endpoints "/users/totp/disable" and "/users/totp/backup-codes" accept only the account password as an authentication factor for operations critical to Multi-Factor Authentication (MFA). An attacker with a user's password can disable Time-based One-Time Password (TOTP) settings or regenerate backup codes without needing the TOTP device or a valid code, rendering two-factor authentication ineffective.

Recommendations Update to version 2.3.2.