{"id":"CVE-2026-120200","kind":"vulnerability","aliases":["CVE-2026-120200"],"related":[],"title":"Nexterm: authenticated users can disrupt other users' remote sessions","description":"Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.","summary":"Nexterm through 1.2.2-BETA lets any logged-in user hibernate, resume, or terminate remote sessions that belong to other users. An attacker who obtains a session ID can disrupt live SSH, RDP, VNC, or SFTP sessions.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nexterm","other","rdp","self-hosted","ssh","vnc"],"not_affected_if":["single-user-instance","versions-after-1.2.2-beta"],"how_to_check":"- Check the installed Nexterm version against the affected range (through `1.2.2-BETA`).\n- Review who holds accounts on the Nexterm instance, since the attacker must be authenticated.","fix":null,"status":"open","published_at":"2026-10-31T18:17:07+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:40:38+00:00","updated_at":"2026-10-31T18:40:38+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-31T18:40:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Nexterm: authenticated users can disrupt other users' remote sessions","impact":"medium","summary":"Nexterm through 1.2.2-BETA lets any logged-in user hibernate, resume, or terminate remote sessions that belong to other users. An attacker who obtains a session ID can disrupt live SSH, RDP, VNC, or SFTP sessions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nexterm","self-hosted","ssh","rdp","vnc"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"other users' live remote sessions get hijacked or killed","analyst_note":"","how_to_check":"- Check the installed Nexterm version against the affected range (through `1.2.2-BETA`).\n- Review who holds accounts on the Nexterm instance, since the attacker must be authenticated.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-instance","versions-after-1.2.2-beta"],"who_is_affected":"Teams that run a self-hosted Nexterm instance with multiple user accounts sharing remote session access. The sources do not say which exact deployments are affected beyond the version range, so the risk is limited to instances with more than one user who can open sessions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":4156,"output_tokens":501,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120200':12A,15A '-2026':11A,14A '1.2.2':26B,63C 'allow':71C 'attack':46B,87C 'authent':2A,72C 'author':68C 'belong':41B 'beta':27B,64C 'call':94C 'connect':100C 'contain':65C 'cve':10A,13A 'delet':99C 'disrupt':5A,53B,103C 'endpoint':101C 'hibern':34B,75C,96C 'host':21B 'id':51B,92C 'let':28B 'lifecycl':85C 'live':54B,104C 'log':31B 'logged-in':30B 'miss':67C 'nexterm':1A,16B,24B,61C 'obtain':48B,89C 'rdp':18B,56B,106C 'remot':8A,38B,81C 'resum':35B,76C,97C 'rout':86C 'self':20B 'self-host':19B 'session':9A,39B,50B,60B,82C,84C,91C,110C 'sftp':59B,109C 'ssh':22B,55B,105C 'termin':37B,78C 'user':3A,7A,33B,44B,73C,80C 'via':83C 'vnc':23B,57B,107C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Nexterm instance with multiple user accounts sharing remote session access. The sources do not say which exact deployments are affected beyond the version range, so the risk is limited to instances with more than one user who can open sessions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120200","severity":null,"published_at":"2026-10-31T18:17:07+00:00","modified_at":"2026-10-31T18:17:07+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}