Live › vulnerability › CVE-2026-120200
Nexterm through 1.2.2-BETA lets any logged-in user hibernate, resume, or terminate remote sessions that belong to other users. An attacker who obtains a session ID can disrupt live SSH, RDP, VNC, or SFTP sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Teams that run a self-hosted Nexterm instance with multiple user accounts sharing remote session access. The sources do not say which exact deployments are affected beyond the version range, so the risk is limited to instances with more than one user who can open sessions.
No product ranges from the sources yet.
1.2.2-BETA).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-120200")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.