Threats tagged 'ghsa-hfqx-wvcm-v3qr'

NextScan versions 1.1.0 through 1.2.0 have an authentication bypass vulnerability in the ns-admin component. This flaw allows unauthenticated attackers to forge administrator tokens by exploiting a hardcoded JWT signing key. Using this, attackers can create an HS256 X-Access-Token with a super administrator role, granting full control over user management, scan tasks, and stored vulnerability data.