Termix versions 1.7.0 through 2.5.1 use hard‑coded default strings to generate the cryptographic keys that wrap the Data Encryption Keys for users authenticated via OIDC or WebAuthn. An adversary who obtains a copy of the SQLite database can derive these wrapping keys because the system secrets (OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET) are not configured by default. From the derived keys the attacker can recover each affected user’s Data Encryption Key and then decrypt all stored SSH passwords, private keys, and key passphrases, leading to full compromise of the credentials that grant remote access to the managed servers. Password‑authenticated users are not impacted by this specific key derivation path.

The vulnerability affects Termix, the web‑based server management platform that provides SSH terminal, tunneling and file editing, as implemented between release 1.7.0 and 2.5.1. The affected versions do not include any provision for setting a custom OIDC_SYSTEM_SECRET or WEBAUTHN_SYSTEM_SECRET; users relying on the default configuration are vulnerable.

The CVSS v3.1 score is 5.5, indicating a medium severity vulnerability. EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires only an offline copy of the SQLite database, which can be obtained through physical access or via export routines. Because the wrapping keys are derived from static defaults, attackers can compute them locally without needing network access or elevated permissions. Once the database copy is in hand, the decryption of SSH credentials can happen entirely offline, making the attack straightforward for an individual with access to the database. Therefore, while the attack requires some initial data acquisition, the subsequent compromise phase is low cost and highly effective.