CyberSecBulletin

Tongcheng-security-team vulnerabilities

We track 2 vulnerabilities in Tongcheng-security-team products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.

2vulnerabilities
1critical
1high
0exploited
9.0average CVSS score

Latest Tongcheng-security-team vulnerabilities

  • 8.2 High severity

    NextScan: Use of Hard-coded Credentials

    CVE-2026-126802Tongcheng-security-team

    NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details

  • 9.8 Critical severity

    NextScan: Use of Hard-coded Cryptographic Key

    CVE-2026-126797Tongcheng-security-team

    NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super