Termix provides web-based management of servers with SSH, tunneling, and file editing. In versions prior to 2.6.1, the GET /host/db/host/:id/password endpoint accepts an authenticated user's numeric host ID and a field query (password or sudoPassword) but does not enforce host ownership when resolving credentials. An attacker who has a valid JWT may enumerate sequential host.id values, triggering a lookup that inadvertently resolves the host in the owner's context and returns the owner's plaintext SSH or sudo password. These disclosed credentials can then be used to access and control servers managed by Termix, extending the attacker's compromise beyond the Termix instance. The issue is fixed in version 2.6.1.

The vulnerability impacts the Termix-SSH Termix platform. All releases before 2.6.1, such as the 2.3.x series, are affected. The issue is fixed in release 2.6.1 and later.

The CVSS score of 9.6 marks this flaw as critical. EPSS data is unavailable, so the exploitation probability cannot be quantified, but the absence of a KEV listing suggests no known public exploits to date. The flaw requires an authenticated web request with a valid JWT, after which the attacker can iterate host IDs, obtain plaintext credentials, and potentially compromise the security of other users' systems.