# CVE-2026-126797: NextScan authentication bypass in ns-admin via hardcoded JWT key

Source: https://junglewise.ai/threats/cve-2026-126797-nextscan-1-1-0-through-1-2-0-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126797 · Severity: critical · CVSS 9.8 · Published 2026-11-11

NextScan is a vulnerability scanning platform that manages security assessments, tasks, and results. An unauthenticated attacker can forge administrator credentials using a hardcoded JWT signing key embedded in the ns-admin component, gaining complete control over the platform including user management, scan configurations, and vulnerability data. This allows total compromise of the scanning infrastructure without legitimate credentials.

Technologies: [Tongcheng-Security-Team NextScan](https://junglewise.ai/threats/technologies/nextscan). Vendors: [Tongcheng-Security-Team](https://junglewise.ai/threats/vendors/tongcheng-security-team).

## Quick answers

**Is CVE-2026-126797 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126797 being exploited in the wild.

**How severe is CVE-2026-126797?** Critical severity, with a CVSS score of 9.8, published 11 November 2026.

**Which products and versions are affected?** Tongcheng-Security-Team NextScan 1.1.0 through 1.2.0.

**Is there a fix for CVE-2026-126797?** Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126797 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126797?** Check whether you run Tongcheng-Security-Team NextScan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

## Technical details

NextScan 1.1.0 through 1.2.0 hardcodes a JWT signing key (nscan_admin_api_jwt_secret_key) in the ns-admin binary, allowing unauthenticated attackers to forge HS256 X-Access-Token headers with super administrator role claims. The vulnerability requires only network access to the ns-admin endpoint; no authentication or user interaction is needed. An attacker gains full administrative access to user management, scan tasks, and stored vulnerability results.

## Affected products

- tongcheng-security-team NextScan 1.1.0 through 1.2.0

## Timeline

- 2026-11-07: disclosed
- 2026-11-11: advisory

## References

- [https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml](https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml)
- [https://github.com/tongcheng-security-team/NextScan/issues/48](https://github.com/tongcheng-security-team/NextScan/issues/48)

## Related threats

- [NextScan hardcoded HTTP Basic Auth credentials in agent routers](https://junglewise.ai/threats/cve-2026-126802-nextscan-1-1-0-through-1-2-0-contains-hardcoded-http-basic-auth)
- [NextScan stored cross-site scripting in asset detail dialog](https://junglewise.ai/threats/cve-2026-126798-nextscan-1-1-0-through-1-2-0-contains-a-stored-cross-site)