Termix versions before 2.3.2 contain an authorization bypass vulnerability (CWE-639) where the terminal WebSocket accepts a user-controlled hostConfig.id. The host resolver does not require ownership or explicit access, and when no credential is shared, it falls back to the owner's credential. The terminal combines this credential with attacker-controlled IP, port, and username values, enabling an authenticated low-privileged user to cause Termix to authenticate to an attacker-controlled SSH server. This leads to disclosure of another user's stored SSH password or private key material while the victim's data key is unlocked. The vulnerability is addressed in version 2.3.2.

An authenticated low-privileged user can bypass authorization controls to cause Termix to authenticate to an attacker-controlled SSH server using another user's credentials. This results in disclosure of sensitive SSH passwords or private keys belonging to other users. The vulnerability has a CVSS 3.1 score of 9.6 (critical), indicating high impact on confidentiality and integrity without affecting availability. There are no known exploits in the wild at this time.

Upgrade Termix to version 2.3.2 or later, where this authorization bypass vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed as an official fix in version 2.3.2.