CVE-2026-45745: Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft

Synopsis

Improper certificate validation in the Termix Desktop (Electron) client allows a machine-in-the-middle attacker to intercept TLS-protected traffic between the client and a Termix server. The flaw was introduced in version 1.7.0, where TLS certificate checking is disabled entirely, and affects all releases through 2.2.1. A successful attacker who can position themselves between the client and server reads or modifies HTTPS traffic, stealing login credentials and active JWT or session tokens. No patched version has been published; HarborGuard tracks this advisory and will make a rebuilt image available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to intercept network traffic between the Termix Desktop client and its configured server, requiring over-the-network positioning such as a compromised router, rogue Wi-Fi access point, or ARP/DNS poisoning on the local segment.

• AuthenticationNot required

  No account or credentials on the target Termix server are needed; the attacker operates at the network layer before any authentication takes place.

• Victim interactionRequired

  A legitimate Termix Desktop user must actively connect to their Termix server, such as by opening the application and logging in, giving the attacker traffic to intercept.

• Attack complexityDetail

  Attack complexity is HIGH because the attacker must successfully position themselves in the network path between the client and server, which requires overcoming environmental factors such as network topology, ARP tables, or DNS resolution before the intercept can occur.

Blast Radius

• The attacker reads plaintext login credentials (usernames and passwords) submitted through the Termix Desktop login flow.
• The attacker captures live JWT and session tokens, which can be replayed to authenticate as the victim user without knowing their password.
• Because the scope is changed (S:C in the CVSS vector), the attacker gains access to the Termix server's managed resources, including SSH sessions, file contents, and tunnel configurations belonging to the victim account.
• The attacker can modify server responses in transit, injecting malicious content or altered commands into the victim's active SSH or file-editing sessions.