{"id":"CVE-2026-120200","published":"2026-10-31T18:17:07.713","lastModified":"2026-10-31T18:17:07.713","description":"Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/gnmyt/Nexterm","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/issues/1944","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/pull/1950","tags":[]},{"url":"https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes","tags":[]}],"exploitRefs":[{"url":"https://github.com/gnmyt/Nexterm","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/issues/1944","tags":[]},{"url":"https://github.com/gnmyt/Nexterm/pull/1950","tags":[]}],"hasPoc":true,"ai":null}