CVE-2026-120200
Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
| CWE | CWE-639 |
| Vendor | gnmyt |
| Product | nexterm |
| Published | Oct 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for gnmyt nexterm
Be the first to know when new medium vulnerabilities affecting gnmyt nexterm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
gnmyt / Nexterm
1.0.6-OPEN-PREVIEW ≤ 1.2.2-BETA
References
github.com: https://github.com/gnmyt/Nexterm/issues/1944 github.com: https://github.com/gnmyt/Nexterm/pull/1950 github.com: https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 github.com: https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87 github.com: https://github.com/gnmyt/Nexterm vulncheck.com: https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes
Credits
HieuPenguinnn