Termix-SSH is a web-based server management platform that includes SSH terminal and file editing features. Between versions 2.4.0 and 2.5.0 inclusive, a regression introduced in a refactor caused the POST endpoints /users/totp/disable and /users/totp/backup-codes to accept only the account password for reauthentication, bypassing the intended two-factor authentication check. The backend function verifyTotpReauth returns success if the password matches, allowing these endpoints to disable TOTP or regenerate backup codes without requiring a valid second factor. This weakens account security by allowing an attacker with an authenticated session and password knowledge to disable 2FA protections. The vulnerability is tracked as CVE-2026-79763 and is fixed in version 2.5.1.

An attacker who has access to a victim's authenticated session and knows the account password can bypass two-factor authentication protections by disabling TOTP or regenerating backup codes without providing a valid second factor. This effectively reduces the account security to single-factor authentication, increasing the risk of account compromise.

Upgrade Termix-SSH to version 2.5.1 or later, where this vulnerability is fixed. Until the upgrade, be aware that accounts may be vulnerable to 2FA bypass if an attacker has both an authenticated session and the account password. No other mitigation is indicated by the vendor advisory.