CVE-2026-126797 NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lysec/ns-admin | >= 1.1.0, <= 1.2.0 | No fix listed |
References
- github.com issue-tracking
- github.com product
- hub.docker.com product
- vul.yulun.ac.cn third-party-advisory
- VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin third-party-advisory