Vulnerability · Published Oct 31, 2026 · Assigned by VulnCheck

CVE-2026-120200Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in Nexterm from gnmyt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.

Affected products (as reported)

Vendor	Product	Versions
gnmyt	Nexterm	1.0.6-OPEN-PREVIEW – through 1.2.2-BETA

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

GitHub Issue #1944 issue-tracking
https://github.com/gnmyt/Nexterm/pull/1950 issue-tracking, patch
https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 patch
https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87 technical-description
https://github.com/gnmyt/Nexterm product
VulnCheck Advisory: Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes third-party-advisory