Field brief
NextScan 1.1.0-1.2.0 Authentication Bypass CVE-2026-126797
A critical authentication bypass in NextScan 1.1.0-1.2.0 allows attackers to forge admin tokens using a hardcoded JWT key, but no vendor advisory has yet been issued.
NextScan 1.1.0 through 1.2.0 contains a critical authentication bypass that lets unauthenticated users forge administrator tokens with a hardcoded JWT signing key. The vulnerability, identified as CVE‑2026‑126797, is rated 9.8 on the CVSS v3.1 scale and would grant full access to user management, scan tasks, and stored vulnerability results. The National Vulnerability Database lists the affected versions but does not yet provide a fixed version or a vendor advisory, and the CISA KEV database has not recorded it. Because no official patch has been released, organizations using these NextScan releases should immediately upgrade to a newer version or apply a manual patch once available. Until a vendor fix has been issued, monitoring for exploitation attempts and applying the hardcoded key change is recommended. For more details, see CVE‑2026‑126797.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.