Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/gnmyt/Nexterm/pull/1950 issue-tracking, patch
- https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · gnmytNVD modified 2026-10-31 17:25
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/gnmyt/Nexterm/issues/1944 issue-tracking
- https://github.com/gnmyt/Nexterm/pull/1950 issue-tracking, patch
- https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 patch
- https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87 technical-description
- https://github.com/gnmyt/Nexterm product
- https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes third-party-advisory