{"id":"CVE-2026-126797","kind":"vulnerability","aliases":["CVE-2026-126797"],"related":[],"title":"NextScan: hardcoded JWT key lets attackers forge admin tokens","description":"NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.","summary":"NextScan versions 1.1.0 through 1.2.0 ship a hardcoded JWT signing key in the ns-admin component. An unauthenticated attacker can forge an administrator token and gain full access to user management, scan tasks and stored vulnerability results.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ns-admin","fixed":[],"affected":">= 1.1.0, <= 1.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-bypass","docker","nextscan","ns-admin","other","self-hosted"],"not_affected_if":["not-network-reachable","version-outside-range"],"how_to_check":"Run lysec/ns-admin images tagged 1.1.0, 1.1.1 or 1.2.0 (docker ps --format '{{.Image}}' | grep ns-admin) or the v1.2.0 ns-admin binary? You are exposed if the ns-admin port (80 in the official compose) is reachable by anyone untrusted. The key is a constant in the binary, so the signature cannot be rotated. Test: strings <ns-admin binary> | grep nscan_admin_api_jwt_secret_key. Also check the same report's other issues: Basic Auth nextagent:nextagent on /agent/config, and stored XSS in the asset detail view.","fix":"No fixed version known: the maintainers' GitHub issue #48 (opened 2026-11-07) is still open with no reply, and the key cannot be changed by configuration.","status":"open","published_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","triaged_at":"2026-11-11T21:30:31+00:00","updated_at":"2026-11-11T21:31:47+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-11T21:30:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"NextScan: hardcoded JWT key lets attackers forge admin tokens","impact":"high","summary":"NextScan versions 1.1.0 through 1.2.0 ship a hardcoded JWT signing key in the ns-admin component. An unauthenticated attacker can forge an administrator token and gain full access to user management, scan tasks and stored vulnerability results.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nextscan","ns-admin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker gains full administrator access to the scanner","analyst_note":"Confirm fixed version and whether ns-admin is exposed by default; check vulncheck advisory.","how_to_check":"- Check the installed NextScan version; versions `1.1.0` through `1.2.0` are affected.\n- Confirm whether the ns-admin service is reachable from the network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"NextScan 1.1.0 through 1.2.0 with the ns-admin component exposed to a network. Sources do not say whether a fixed version exists or which deployments are affected by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000705,"input_tokens":4615,"output_tokens":487,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm fixed version and whether ns-admin is exposed by default; check vulncheck advisory.","search":"'-126797':12A,15A '-2026':11A,14A '1.1.0':33B,70C '1.2.0':35B,72C 'access':59B,103C,115C 'admin':8A,18A,26B,46B,81C 'administr':54B,88C,109C 'allow':83C 'attack':6A,50B,85C,96C 'auth':20B 'auth-bypass':19B 'authent':75C 'bypass':21B,76C 'carri':105C 'compon':47B 'contain':73C 'cve':10A,13A 'docker':22B 'forg':7A,52B,87C 'full':58B,114C 'gain':57B,113C 'hardcod':2A,38B,92C 'host':30B 'hs256':100C 'id':111C 'jwt':3A,39B,93C 'key':4A,41B,95C 'let':5A 'manag':62B,118C 'nextscan':1A,23B,31B,69C 'ns':17A,25B,45B,80C 'ns-admin':16A,24B,44B,79C 'public':107C 'result':68B,124C 'role':110C 'scan':63B,119C 'self':29B 'self-host':28B 'ship':36B 'sign':40B,94C,98C 'store':66B,122C 'super':108C 'task':64B,120C 'token':9A,55B,89C,104C 'unauthent':49B,84C 'use':90C 'user':61B,117C 'version':32B 'vulner':67B,77C,123C 'x':102C 'x-access-token':101C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted NextScan (Tongcheng ns-admin) 1.1.0 to 1.2.0, including the published images 1.1.0, 1.1.1 and 1.2.0. Any deployment whose ns-admin web/API port is reachable by an attacker is exposed with no preconditions, including the official docker-compose setup, which publishes port 80. The key is hardcoded and cannot be changed by configuration. Teams that do not run NextScan, or keep ns-admin reachable only from a trusted network or VPN, face much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["nsadmin"],"ptokens":["admin","ns"],"labels":["authbypass","critical","docker","nextscan","nsadmin","other","selfhosted"],"campaign_type":null,"search_a":"'-126797':12A,15A '-2026':11A,14A 'admin':8A,18A 'attack':6A 'cve':10A,13A 'forg':7A 'hardcod':2A 'jwt':3A 'key':4A 'let':5A 'nextscan':1A 'ns':17A 'ns-admin':16A 'token':9A","search_b":"'1.1.0':33B '1.2.0':35B 'access':59B 'admin':26B,46B 'administr':54B 'attack':50B 'auth':20B 'auth-bypass':19B 'bypass':21B 'compon':47B 'docker':22B 'forg':52B 'full':58B 'gain':57B 'hardcod':38B 'host':30B 'jwt':39B 'key':41B 'manag':62B 'nextscan':23B,31B 'ns':25B,45B 'ns-admin':24B,44B 'result':68B 'scan':63B 'self':29B 'self-host':28B 'ship':36B 'sign':40B 'store':66B 'task':64B 'token':55B 'unauthent':49B 'user':61B 'version':32B 'vulner':67B","search_c":"'1.1.0':70C '1.2.0':72C 'access':103C,115C 'admin':81C 'administr':88C,109C 'allow':83C 'attack':85C,96C 'authent':75C 'bypass':76C 'carri':105C 'contain':73C 'forg':87C 'full':114C 'gain':113C 'hardcod':92C 'hs256':100C 'id':111C 'jwt':93C 'key':95C 'manag':118C 'nextscan':69C 'ns':80C 'ns-admin':79C 'public':107C 'result':124C 'role':110C 'scan':119C 'sign':94C,98C 'store':122C 'super':108C 'task':120C 'token':89C,104C 'unauthent':84C 'use':90C 'user':117C 'vulner':77C,123C 'x':102C 'x-access-token':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-126797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126797","severity":null,"published_at":"2026-11-11T21:16:43+00:00","modified_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","fetched_at":"2026-11-11T21:29:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126797:3596","url":"https://github.com/tongcheng-security-team/NextScan/issues/48","severity":null,"published_at":"2026-11-11T21:31:47+00:00","modified_at":"2026-11-11T21:31:47+00:00","first_seen_at":"2026-11-11T21:31:47+00:00","fetched_at":"2026-11-11T21:31:47+00:00","note":"Read the VulnCheck advisory, the maintainer issue #48 and the researcher write-up (reproduction with forged HS256 X-Access-Token). Affected range confirmed by researcher; no fix or vendor reply found. Not verified: researcher's words only.","cites":["https://github.com/tongcheng-security-team/NextScan/issues/48","https://vul.yulun.ac.cn/20261107/nextscan/"]}],"documents":[{"id":128957,"url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":129189,"url":"https://github.com/tongcheng-security-team/NextScan/issues/48","title":"NextScan issue #48: hardcoded admin JWT key (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129190,"url":"https://vul.yulun.ac.cn/20261107/nextscan/","title":"NextScan Vulnerability Report (Wu Yulun)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vul.yulun.ac.cn/20261107/nextscan/"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}