CVE-2026-126797

NextScan versions 1.1.0 through 1.2.0 are vulnerable to an authentication bypass in the ns-admin component. The root cause is the use of a hardcoded JWT signing key (CWE-321), which allows unauthenticated attackers to forge an HS256 X-Access-Token . By carrying the public super administrator role...