Termix is a web‑based server management platform that includes an SSH terminal. A missing authorization check in the SSH host credential resolution logic allows a terminal WebSocket to accept a user‑controlled hostConfig.id and resolve that host without verifying ownership or explicit access. When the requester has no shared credentials, the resolver falls back to an owner credential and the terminal combines that credential with attacker‑controlled IP, port, and username values. As a result, an authenticated low‑privileged user can force Termix to authenticate to an attacker‑controlled SSH server and expose another user’s stored SSH password or private‑key material while the victim user’s data key is unlocked.

All releases of Termix-SSH:Termix prior to version 2.3.2 are affected. The vulnerability was corrected in release 2.3.2 and later.

The vulnerability carries a CVSS score of 9.6, indicating critical severity, and is not currently listed in the CISA KEV catalog. EPSS data is not available, but the lack of a score does not mean low exploitation probability; the flaw is exploitable via ordinary application traffic. An attacker must have a legitimate low‑privileged user account with access to the terminal feature (i.e., be authenticated to the web application) to perform the exploit. Based on the description, it is inferred that the exposed SSH credentials could allow an attacker to gain unauthorized access to backend hosts, potentially leading to lateral movement and further credential theft.