EUVD-2026-124012

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full...

CVE-2026-126797

NextScan versions 1.1.0 through 1.2.0 are vulnerable to an authentication bypass in the ns-admin component. The root cause is the use of a hardcoded JWT signing key (CWE-321), which allows unauthenticated attackers to forge an HS256 X-Access-Token . By carrying the public super administrator role...