CVE-2026-120200 | BDVDB-2026-398713 Detail
gnmytNexterm
Description#
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact low. Attack vector: network.
Weaknesses#
- CWE-639 Authorization Bypass Through User-Controlled Key
References#
- https://github.com/gnmyt/Nexterm/issues/1944
- https://github.com/gnmyt/Nexterm/pull/1950
- https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657
- https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87
- https://github.com/gnmyt/Nexterm
- https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.