Termix Desktop, the Electron-based client for Termix, disables TLS certificate validation starting with version 1.7.0. This flaw allows a network attacker to perform a man‑in‑the‑middle attack, intercept and modify HTTPS traffic to the configured Termix server, capturing credentials entered during login and JWT/session tokens used during normal use. The weakness is a classic certificate validation error (CWE‑295), resulting in a loss of confidentiality for user credentials and tokens. An attacker does not need privileged access to the Termix server; only the ability to interpose on the client‑to‑server connection is required.

The vulnerability affects Termix Desktop, the Electron client for the Termix web‑based server management platform, for all releases version 1.7.0 and later. No fixed version is currently available.

The CVSS score is 8.0, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a compromised local network or an attacker capable of reflecting traffic to the client. Because no patch has been released, the risk remains high for all users of Termix Desktop 1.7.0 or newer who have not isolated themselves from potential MITM traffic.