The vulnerability allows an attacker who knows a user’s account password to invoke the /users/totp/disable or /users/totp/backup‑codes endpoints and remove the requirement for a time‑based one‑time password. The attacker never needs the physical token or a valid TOTP code, so the MFA protection is eliminated, resulting in loss of confidentiality and integrity for all actions performed by the compromised account.

Termix, the web‑based server management platform by Termix‑SSH, is affected in all releases prior to 2.3.2. The issue is fixed in release 2.3.2 and later versions.

The CVSS score of 8.1 indicates high severity. Though the EPSS score is not available and the vulnerability is not listed in KEV, the attack vector depends solely on possession of a valid user password, which an adversary can obtain via phishing, credential stuffing, or a password hash leak. Once the password is known, the attacker can disable MFA without further user interaction, making exploitation straightforward and potentially undetected without monitoring.