CVE-2026-120200
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Oct 31, 2026
CISA due date
—
The record
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows… CWE-639
- CVE-2026-121732 RosarioSIS before 12.9 contains an improper authorization vulnerability that allows… CWE-639
- CVE-2026-121582 A vulnerability has been found in Umami up to 3.4.1. CWE-639
- CVE-2026-116669 Tanium addressed an improper access controls vulnerability in Discover. CWE-639
- CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the… CWE-639
- CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can… CWE-639
- CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to… CWE-639
- CVE-2026-121560 LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that… CWE-639