CVE-2026-79762 (GCVE-0-2026-79762)
Vulnerability from cvelistv5
Published
2026-09-24 16:01
Modified
2026-09-28 15:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Summary
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Termix-SSH | Termix |
Version: >= 1.7.0, < 2.5.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79762",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:35:15.154188Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:35:21.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Termix",
"vendor": "Termix-SSH",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.7.0, \u003c 2.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users\u0027 Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project\u0027s default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user\u0027s DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321: Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:01:42.694Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m"
},
{
"name": "https://github.com/Termix-SSH/Termix/pull/1067",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Termix-SSH/Termix/pull/1067"
},
{
"name": "https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8"
},
{
"name": "https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e"
},
{
"name": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag"
}
],
"source": {
"advisory": "GHSA-685g-ccvv-6p8m",
"discovery": "UNKNOWN"
},
"title": "Termix: Hardcoded default key encrypts all OIDC/WebAuthn users\u0027 stored SSH credentials \u2014 full offline decryption from a database copy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-79762",
"datePublished": "2026-09-24T16:01:42.694Z",
"dateReserved": "2026-08-25T14:08:18.111Z",
"dateUpdated": "2026-09-28T15:35:21.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-79762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-28T15:35:15.154188Z\"}}}], \"references\": [{\"url\": \"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-28T15:34:57.000Z\"}}], \"cna\": {\"title\": \"Termix: Hardcoded default key encrypts all OIDC/WebAuthn users\u0027 stored SSH credentials \\u2014 full offline decryption from a database copy\", \"source\": {\"advisory\": \"GHSA-685g-ccvv-6p8m\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Termix-SSH\", \"product\": \"Termix\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.7.0, \u003c 2.5.1\"}]}], \"references\": [{\"url\": \"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m\", \"name\": \"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Termix-SSH/Termix/pull/1067\", \"name\": \"https://github.com/Termix-SSH/Termix/pull/1067\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8\", \"name\": \"https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e\", \"name\": \"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag\", \"name\": \"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users\u0027 Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project\u0027s default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user\u0027s DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-321\", \"description\": \"CWE-321: Use of Hard-coded Cryptographic Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-24T16:01:42.694Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-79762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-28T15:35:21.631Z\", \"dateReserved\": \"2026-08-25T14:08:18.111Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-24T16:01:42.694Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…