{"id":"CVE-2026-120200","title":"Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes","summary":"Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"gnmyt","product":"Nexterm","affected":["Nexterm >= 1.0.6-OPEN-PREVIEW <= 1.2.2-BETA"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T17:03:44.303344Z"},"published":"2026-10-31","updated":"2026-11-02","sourceUpdated":"2026-11-02T17:51:26.402Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120200","references":[{"url":"https://github.com/gnmyt/Nexterm/issues/1944","label":"GitHub Issue #1944"},{"url":"https://github.com/gnmyt/Nexterm/pull/1950"},{"url":"https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657"},{"url":"https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87"},{"url":"https://github.com/gnmyt/Nexterm"},{"url":"https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes","label":"VulnCheck Advisory: Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes"}],"tags":["cve.org"],"epss":0.00227,"epssPercentile":0.1355,"ingestedAt":"2026-11-05T19:30:42.753Z","slug":"CVE-2026-120200","body":"## Overview\n\nNexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.\n\n## Affected\n\n- `Nexterm >= 1.0.6-OPEN-PREVIEW <= 1.2.2-BETA`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}