[ CVE-2026-120200 · Published 31 Oct 2026 ]
Vulnerability in gnmyt Nexterm
CVSS 5.4
EPSS <1%No fix listed yet
[ Description ]Official description
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/gnmyt/Nexterm
- github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js
- github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657
- github.com/gnmyt/Nexterm/issues/1944
- github.com/gnmyt/Nexterm/pull/1950
- www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server…