CVE-2026-126797

Name of the Vulnerable Software and Affected Versions NextScan versions 1.1.0 through 1.2.0

Description An authentication bypass exists in the ns-admin component. Unauthenticated remote attackers can forge administrator tokens by utilizing a hardcoded JWT signing key to sign an X-Access-Token using the HS256 algorithm. By including the public super administrator role ID, an attacker can obtain full access to user management, scan tasks, and stored results.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.