---
id: "CVE-2026-126797"
page: "https://infrastack.ai/live/CVE-2026-126797"
kind: "vulnerability"
aliases: ["CVE-2026-126797"]
title: "NextScan: hardcoded JWT key lets attackers forge admin tokens"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ns-admin", "fixed": [], "affected": ">= 1.1.0, <= 1.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-bypass", "docker", "nextscan", "ns-admin", "other", "self-hosted"]
not_affected_if: ["not-network-reachable", "version-outside-range"]
published_at: "2026-11-11T21:16:43+00:00"
first_seen_at: "2026-11-11T21:29:07+00:00"
updated_at: "2026-11-11T21:31:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126797", "first_seen_at": "2026-11-11T21:29:07+00:00"}, {"source": "analyst", "url": "https://github.com/tongcheng-security-team/NextScan/issues/48", "first_seen_at": "2026-11-11T21:31:47+00:00", "cites": ["https://github.com/tongcheng-security-team/NextScan/issues/48", "https://vul.yulun.ac.cn/20261107/nextscan/"]}]
exploit_sources: [{"type": "poc", "url": "https://vul.yulun.ac.cn/20261107/nextscan/"}]
---

# NextScan: hardcoded JWT key lets attackers forge admin tokens

Link for people: https://infrastack.ai/live/CVE-2026-126797 (this .md is for agents)

NextScan versions 1.1.0 through 1.2.0 ship a hardcoded JWT signing key in the ns-admin component. An unauthenticated attacker can forge an administrator token and gain full access to user management, scan tasks and stored vulnerability results.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ns-admin affected >= 1.1.0, <= 1.2.0 fixed no fixed version listed

## How to check

Run lysec/ns-admin images tagged 1.1.0, 1.1.1 or 1.2.0 (docker ps --format '{{.Image}}' | grep ns-admin) or the v1.2.0 ns-admin binary? You are exposed if the ns-admin port (80 in the official compose) is reachable by anyone untrusted. The key is a constant in the binary, so the signature cannot be rotated. Test: strings <ns-admin binary> | grep nscan_admin_api_jwt_secret_key. Also check the same report's other issues: Basic Auth nextagent:nextagent on /agent/config, and stored XSS in the asset detail view.

## Fix

No fixed version known: the maintainers' GitHub issue #48 (opened 2026-11-07) is still open with no reply, and the key cannot be changed by configuration.

## Timeline

- 2026-11-11T21:29:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126797
- 2026-11-11T21:31:47+00:00 analyst https://github.com/tongcheng-security-team/NextScan/issues/48 — Read the VulnCheck advisory, the maintainer issue #48 and the researcher write-up (reproduction with forged HS256 X-Access-Token). Affected range confirmed by researcher; no fix or vendor reply found. Not verified: researcher's words only.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin
- [advisory] NextScan issue #48: hardcoded admin JWT key (open) https://github.com/tongcheng-security-team/NextScan/issues/48
- [poc] NextScan Vulnerability Report (Wu Yulun) https://vul.yulun.ac.cn/20261107/nextscan/

## From the sources

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_