MEDIUM 5.3 NVD
CVE-2026-120200
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
References
- https://github.com/gnmyt/Nexterm
- https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87
- https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657
- https://github.com/gnmyt/Nexterm/issues/1944
- https://github.com/gnmyt/Nexterm/pull/1950
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-31 via NVD.
vulnfeed aggregates 18454 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.