VYPR
← All advisories
High severity8.0NVD Advisory· Published Jun 5, 2026· Updated Jun 5, 2026

CVE-2026-45745

CVE-2026-45745

Description

Termix Desktop (Electron) improperly validates TLS certificates, enabling MITM attacks to steal credentials and session tokens.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Termix Desktop (Electron) improperly validates TLS certificates, enabling MITM attacks to steal credentials and session tokens.

Vulnerability

Starting in version 1.7.0, the Termix Desktop (Electron) application globally disables TLS certificate validation. This is achieved through startup flags like --ignore-certificate-errors and by setting rejectUnauthorized: false in custom HTTPS logic. This allows a network attacker to intercept and modify HTTPS traffic to the configured Termix server [1].

Exploitation

An attacker must be in a network position to intercept the victim's HTTPS connection to the Termix server, such as via a malicious Wi-Fi network or proxy. The attacker then intercepts the connection using an untrusted or self-signed certificate. When a user opens Termix Desktop and connects to the compromised server, the application will proceed despite the invalid certificate, allowing the attacker to capture or modify authentication traffic, including credentials and JWT/session tokens [1].

Impact

Successful exploitation allows a machine-in-the-middle attacker to steal user credentials and JWT/session tokens during login and normal use. This results in account and session compromise, with high confidentiality and integrity impact for the affected users [1].

Mitigation

As of the time of publication, no patched versions of Termix Desktop are available. Users connecting to remote Termix servers over potentially untrusted networks should be aware of this vulnerability. Further mitigation details are not yet disclosed in the available references [1].

References
  1. Improper certificate validation in Electron desktop client enables MITM credential/token theft

AI Insight generated on Jun 5, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2
  • Termix SSH/Termixinferred2 versions
    >=1.7.0+ 1 more
    • (no CPE)range: >=1.7.0
    • (no CPE)range: >=1.7.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Termix Desktop (Electron) disables TLS certificate validation."

Attack vector

An attacker must be in a network path to intercept HTTPS traffic to the Termix server, such as via a malicious Wi-Fi network or proxy [ref_id=1]. The attacker then intercepts the victim's connection to the Termix server using an untrusted or self-signed certificate. When the victim opens Termix Desktop and connects to the server, the application will succeed despite the invalid certificate, allowing the attacker to capture or modify authentication and API traffic [ref_id=1].

Affected code

The vulnerability exists in the Termix Desktop (Electron) client. Specifically, global ignore flags in Electron startup such as '--ignore-certificate-errors', '--ignore-ssl-errors', and '--ignore-certificate-errors-spki-list' are used. Additionally, custom HTTPS logic sets 'rejectUnauthorized: false' and 'checkServerIdentity: () => undefined' [ref_id=1]. These settings are configured in the electron main process setup and affect the desktop authentication iframe flow.

What the fix does

The advisory does not specify any patched versions or provide details on a fix. It states that as of the time of publication, no known patched versions are available. Therefore, users are advised to avoid connecting to remote Termix servers over untrusted networks.

Preconditions

  • networkAttacker must be in a network path to intercept HTTPS traffic to the Termix server.
  • inputAttacker must use an untrusted or self-signed certificate to intercept the connection.

Reproduction

1. Place an attacker in the network path (e.g., malicious Wi-Fi/proxy). 2. Intercept victim HTTPS connection to configured Termix server with an untrusted/self-signed cert. 3. Open Termix Desktop and connect/login to that server. 4. Observe connection succeeds despite invalid cert. 5. Capture/modify auth/API traffic to obtain credentials or JWT [ref_id=1].

Generated on Jun 5, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

1