Unauthenticated attackers can forge super administrator tokens in NextScan 1.1.0 through 1.2.0 because the ns-admin component uses a hardcoded JWT signing key.
What Is It
CVE-2026-126797 is an authentication bypass in the ns-admin component of NextScan, a product from tongcheng-security-team. Versions 1.1.0 through 1.2.0 sign authentication tokens with a hardcoded JWT key. Anyone who knows that key can sign their own HS256 X-Access-Token that carries the public super administrator role ID, and the application accepts it as a valid admin session. The flaw is classified as CWE-321 (Use of Hard-coded Cryptographic Key). VulnCheck ([email protected]) assigned and disclosed the CVE, and NVD published it on 2026-11-11.
Why It Matters
A forged token gives full access to user management, scan tasks and stored vulnerability results. That last item is the serious one: a vulnerability scanner's results list the weaknesses in the environment it scanned. An attacker who gets in can read that list and use it to pick targets.
VulnCheck rates the issue Critical:
- CVSS 3.1: 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack works over the network, has low complexity, needs no privileges and needs no user interaction. - CVSS 4.0: 9.3, with high confidentiality, integrity and availability impact on the vulnerable system.
CVE-2026-126797 is not in the CISA Known Exploited Vulnerabilities catalog, and the supplied data does not confirm active exploitation. NVD lists the record's status as "Received," so it has not been analyzed yet.
What's Vulnerable
- Vendor: tongcheng-security-team
- Product: NextScan (ns-admin component)
- Package:
pkg:docker/lysec/ns-admin - Affected versions: 1.1.0 through 1.2.0, inclusive (semver)
The references include the project's v1.2.0 docker/docker-compose.yaml and the lysec/ns-admin image on Docker Hub. Teams that deployed NextScan from these container artifacts should check which versions they are running.
Patch Status
The supplied KEV and NVD data do not name a fixed version or official remediation. There is no CISA KEV entry, so no CISA-required action or due date applies. Defenders should follow the GitHub issue (#48) and the VulnCheck advisory for fix guidance.
Until a fix is available, find any NextScan ns-admin deployments in the affected range. If one of these instances can be reached over the network, anyone who can reach it can forge a super administrator token, take over the admin console and read your stored scan results. Because the signing key is hardcoded, you cannot trust any login token on these versions.