Summary
CVE-2026-126797 is an authentication bypass in the ns-admin component of NextScan 1.1.0 through 1.2.0. The product uses a hardcoded JWT signing key, so an unauthenticated attacker can mint their own administrator credentials. NVD lists a CVSS score of 9.8.
Details
An attacker can sign an HS256 X-Access-Token that carries the public super administrator role ID. Because the signing key is embedded in the software, the forged token is accepted as valid and grants full administrative access to the application.
| Item | Detail |
|---|---|
| CVE | CVE-2026-126797 |
| Affected | NextScan 1.1.0 through 1.2.0 |
| Component | ns-admin |
| Attack | Forged HS256 X-Access-Token |
| Auth required | None |
| CVSS | 9.8 |
Mitigation
- Check the NextScan project for a fixed release newer than 1.2.0 and upgrade. No patch details were included in the NVD entry at the time of writing.
- Until patched, do not expose
ns-adminto untrusted networks; restrict it by IP, VPN or a reverse proxy with its own authentication. - Review admin activity and created accounts for signs of unauthorized access, and rotate any secrets the application stores.
- Because the key is shared across installs, treat any previously issued tokens as untrustworthy.