Description
NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tongcheng-security-team | NextScan | 1.1.0 – ≤ 1.2.0 | — |
References
- https://github.com/tongcheng-security-team/NextScan/issues/48 issue-tracking
- https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml product
- https://hub.docker.com/r/lysec/ns-admin product
- https://vul.yulun.ac.cn/20261107/nextscan/ third-party-advisory
- VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin third-party-advisory