NextScan: Authentication bypass in ns-admin (CVE-2026-126797)

NextScan versions 1.1.0 through 1.2.0 are vulnerable to an authentication bypass in the ns-admin component. The vulnerability arises from the use of a hardcoded JWT signing key, which allows an unauthenticated attacker to forge HS256-signed X-Access-Token values. By embedding the public super administrator role ID in the forged token, an attacker can gain full access to user management, scan tasks, and sensitive vulnerability data stored within the system.

Impact

Successful exploitation allows an unauthenticated attacker to bypass authentication, assume super administrator privileges, and gain unauthorized access to all administrative functions and data managed by the NextScan instance.

Recommendation

Inventory all instances of NextScan within your environment. Currently, no patch information is available; restrict network access to the management interface (ns-admin) to trusted IP ranges only until the vendor provides a remediation or update.