CVE-2026-120200— Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes

Quick assessment

Affected

gnmyt Nexterm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nexterm 1.2.2-BETA 及更早版本存在一个缺失授权（Missing Authorization）漏洞，允许已认证用户通过会话生命周期接口休眠、恢复或终止其他用户的远程会话。攻击者若获取到会话 ID，即可调用休眠、恢复或删除连接端点，从而中断正在进行的 SSH、RDP、VNC 或 SFTP 会话。

CVSS 5.4 · Medium Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1499.002 · Service Exhaustion Flood T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
gnmyt	Nexterm	`1.0.6-OPEN-PREVIEW≤ 1.2.2-BETA`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes

Source: CVE Program / CVE List V5

Vulnerability Description

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gnmyt	Nexterm	1.0.6-OPEN-PREVIEW ~ 1.2.2-BETA	-

II. Public POCs for CVE-2026-120200

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120200

请登录查看更多情报信息。

Other References for CVE-2026-120200 (6)

https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87 technical-description
https://github.com/gnmyt/Nexterm/pull/1950 issue-tracking patch
https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 patch
https://github.com/gnmyt/Nexterm product
https://github.com/gnmyt/Nexterm/issues/1944 issue-tracking
https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120200

IV. Related Vulnerabilities

Same weakness: CWE-639