CVE-2026-45749 describes a weakness in Termix-SSH's Termix platform where the POST endpoints /users/totp/disable and /users/totp/backup-codes accept only the account password to perform MFA-sensitive actions. This effectively reduces MFA to single-factor authentication, enabling attackers with the password to disable TOTP or generate backup codes without the TOTP device or code. The vulnerability is classified as CWE-308 (Use of Single-factor Authentication) and affects versions prior to 2.3.2. The CVSS v3.1 score is 8.1, indicating high severity. No official remediation level or patch link is provided in the data, but version 2.3.2 is noted as patched.

An attacker who obtains a user's password through phishing, credential stuffing, or other means can bypass two-factor authentication by disabling TOTP or regenerating backup codes without needing the second factor. This compromises the confidentiality and integrity of user accounts, allowing unauthorized access with high impact on confidentiality and integrity, but no direct impact on availability is indicated.

Upgrade Termix to version 2.3.2 or later, where this vulnerability is fixed. Since the vendor advisory or patch links are not explicitly provided, verify the update from official Termix sources before applying. Until patched, consider additional controls to protect user passwords and monitor for suspicious account activity related to MFA settings changes.