Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes (CVE-2026-120200)
Executive & SecOps Summary
SECOPS ASSESSMENTAll deployments running Nexterm through version 1.2.2-BETA
Authenticated attackers can disrupt, hibernate, resume, or terminate active SSH, RDP, VNC, or SFTP sessions of other users by exploiting missing authorization checks on session lifecycle routes
Immediately upgrade to the patched version of Nexterm and restrict access to session management API endpoints
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update your Nexterm deployment to the latest patched version. If you are running Nexterm via Docker, use the following commands to pull and deploy the secure image:
# Stop and remove the vulnerable container
docker stop nexterm-container
docker rm nexterm-container
# Pull the latest secure image and run the container
docker pull gnmyt/nexterm:latest
docker run -d --name nexterm-container -p 8080:8080 gnmyt/nexterm:latest2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, implement access control rules at the reverse proxy level (e.g., Nginx) to restrict access to the vulnerable session API endpoints.
# Restrict access to session lifecycle endpoints in Nginx
location ~* ^/api/serverSession/(hibernate|resume|delete) {
allow 10.0.0.0/8; # Restrict to internal admin network
deny all;
proxy_pass http://localhost:8080;
}3. Log Audit & IoC Verification Commands
Inspect your container logs to identify potential exploitation attempts targeting the session lifecycle endpoints.
# Search Nexterm logs for unauthorized session manipulation requests
docker logs nexterm-container 2>&1 | grep -E 'POST|DELETE' | grep -E '/api/serverSession/'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120200) exists in the session lifecycle management routes (server/routes/serverSession.js) of Nexterm, an open-source remote access gateway. The application fails to perform proper authorization checks when processing requests to modify session states. Consequently, any authenticated user can manipulate the lifecycle of sessions belonging to other users simply by referencing their session IDs, leading to an Insecure Direct Object Reference (IDOR) vulnerability classified under CWE-639.
2. Exploitation Mechanics & Attack Scenario
An attacker with low-privileged access to the Nexterm platform can intercept or guess the session IDs of other active users. By sending direct HTTP requests to the session lifecycle endpoints (such as hibernate, resume, or DELETE connection routes), the attacker can bypass ownership validation. The server processes these unauthorized requests, allowing the attacker to abruptly terminate or freeze active SSH, RDP, VNC, or SFTP connections of administrators or other engineers.
3. Infrastructure & Business Impact
Because Nexterm serves as a centralized gateway for managing critical infrastructure, unauthorized session termination poses a significant threat to operational continuity. Attackers can leverage this vulnerability to perform denial-of-service (DoS) attacks against system administrators during critical maintenance windows, potentially disrupting incident response efforts or ongoing deployment pipelines.
Official Vendor Advisories & References
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Frequently Asked SecOps Questions (CVE-2026-120200)
FAQQ1. How critical is CVE-2026-120200 and is it actively exploited in the wild?
CVE-2026-120200 is rated CVSS 5.4 (MEDIUM) with a 30-day EPSS exploitation probability of 0.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120200?
Primary impacted vendors include gnmyt across nexterm. Scope summary: All Nexterm installations up to and including version 1.2.2-BETA
Q3. What temporary mitigations or workarounds exist for CVE-2026-120200 before patching?
[Mitigation] Immediately upgrade to the patched version of Nexterm and restrict access to session management API endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120200
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gnmyt)
View Category →Langflow /api/v1/responses IDOR Vulnerability Leading to Unauthorized Flow Execution (CVE-2026-55255)
[Affected Scope] Langflow versions prior to 1.9.1
IXP Manager IDOR Vulnerability in API Key Management (CVE-2026-63338)
[Affected Scope] All IXP Manager installations prior to version 7.3.0.
YITH WooCommerce Product Add-Ons Unauthenticated Bypass Vulnerability (CVE-2026-107868)
[Affected Scope] YITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.
LearnHouse Missing Authorization in Assignment API Vulnerability (CVE-2026-120199) Analysis & Mitigation Guide
[Affected Scope] LearnHouse versions prior to 1.1.1
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.