Termix’s 2.4.0 through 2.5.1 releases allowed the POST /users/totp/disable and POST /users/totp/backup-codes endpoints to accept the account password alone as a reauthentication factor. The code treated the password and the TOTP code as interchangeable credentials, so an attacker who has an authenticated session and knows the victim’s password could disable TOTP or regenerate backup codes without a valid second factor, effectively reducing the account to single‑factor authentication.

The affected product is Termix by Termix-SSH. Versions from 2.4.0 up to and including 2.5.1 are vulnerable; the issue is remedied in 2.5.1 and later.

The CVSS score of 5.3 reflects a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is over the web application; an attacker must already have a valid session and the victim’s password. Once the conditions are met, disabling TOTP or invalidating backup codes can be performed via the vulnerable HTTP POST endpoints, weakening the account to single‑factor authentication.