CVE-2026-10056: Nx Witness VMS Auth Bypass Vulnerability

CVE-2026-10056 Overview

CVE-2026-10056 is a Cross-Origin Resource Sharing (CORS) misconfiguration in the REST API of Network Optix Nx Witness Video Management System (VMS). The flaw affects versions prior to 6.1.2 running in the default Standard security mode on Linux and Windows. An unauthenticated remote attacker can steal an authenticated user's session token by luring the victim to a malicious cross-origin web page. Successful exploitation results in Administrator Account Takeover of the VMS. Installations configured with High security mode are not affected. The vulnerability is tracked under CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
An attacker who tricks an authenticated administrator into visiting a malicious page can hijack their session token and take full control of the Nx Witness VMS.

Affected Products

Network Optix Nx Witness VMS versions prior to 6.1.2 (Linux)
Network Optix Nx Witness VMS versions prior to 6.1.2 (Windows)
Installations running in the default Standard security mode

Discovery Timeline

2026-05-29 - CVE-2026-10056 published to the National Vulnerability Database (NVD)
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10056

Vulnerability Analysis

The Nx Witness VMS REST API in Standard security mode responds to cross-origin requests with the Access-Control-Allow-Credentials header set to true. Combined with an overly permissive origin reflection policy, this allows browsers to attach the victim's authenticated session cookies to attacker-controlled cross-origin requests. The attacker's JavaScript can then read responses containing the session token. With this token, the attacker authenticates to the API as the victim and performs Administrator account takeover. The attack requires user interaction, as the victim must visit a malicious page while logged in.

Root Cause

The root cause is an insecure default CORS policy in the REST API. In Standard security mode, the server emits Access-Control-Allow-Credentials: true and accepts origins outside of an enforced allow-list. This violates the browser same-origin protections that normally prevent third-party sites from reading authenticated API responses. The High security mode disables this permissive behavior, confirming the issue is a configuration design flaw rather than a protocol weakness.

Attack Vector

Exploitation proceeds in four stages. First, the attacker hosts a malicious web page on any origin. Second, an authenticated Nx Witness user is social-engineered into visiting that page. Third, the page issues credentialed fetch or XMLHttpRequest calls to the victim's Nx Witness REST API endpoint, such as /rest/v2/login/sessions. Fourth, because the server returns permissive CORS headers with credentials allowed, the attacker's script reads the returned session token and replays it to gain Administrator privileges. No prior authentication or network position on the victim's network is required beyond reaching the VMS host.

The vulnerability manifests in the REST API's CORS response headers. See the Network Optix CORS Validation Guide for the protocol-level details of the affected configuration.

Detection Methods for CVE-2026-10056

Indicators of Compromise

HTTP responses from Nx Witness REST API endpoints containing Access-Control-Allow-Credentials: true together with reflected or wildcard Access-Control-Allow-Origin values.
Unexpected OPTIONS preflight requests to /rest/v2/ endpoints originating from external referrers.
Successful authenticated REST API calls from IP addresses or user agents that do not match historical administrator activity.
Creation or modification of administrator accounts shortly after a user visited an external web page.

Detection Strategies

Inspect outbound HTTP responses from Nx Witness servers for permissive CORS headers using a web proxy or network capture.
Correlate browser referrer logs with REST API session creation events to identify cross-origin session theft.
Monitor Nx Witness audit logs for administrator role assignments, password changes, and new session tokens issued from unusual origins.

Monitoring Recommendations

Forward Nx Witness audit and access logs to a centralized SIEM or data lake for retention and correlation.
Alert on REST API requests where the Origin header does not match the approved management origin list.
Track all configuration changes to supportedOrigins and the security mode setting in /rest/v2/system/settings.

How to Mitigate CVE-2026-10056

Immediate Actions Required

Upgrade Nx Witness VMS to version 6.1.2 or later, where Access-Control-Allow-Credentials defaults to false in Standard security mode.
Audit existing administrator accounts and rotate credentials for any account that may have authenticated since deployment.
Invalidate active sessions after the upgrade to force re-authentication and discard any potentially stolen tokens.
Restrict network exposure of the Nx Witness REST API to trusted management networks where feasible.

Patch Information

Network Optix has released Nx Witness VMS version 6.1.2, which sets Access-Control-Allow-Credentials to false in the default Standard security configuration. Administrators should consult the Network Optix CORS Validation Guide for post-upgrade verification steps and origin allow-list configuration.

Workarounds

For installations that cannot be upgraded immediately, set Access-Control-Allow-Credentials to false via the REST API by issuing PATCH /rest/v2/system/settings with the body {"supportedOrigins": "null"}.
Select the High security level during initial setup of new installations, as High security mode is not affected by this vulnerability.
Educate administrators to log out of the Nx Witness web interface before browsing untrusted sites to reduce the window for cross-origin session theft.

bash

# Disable credentialed CORS on existing Standard-mode installations
curl -X PATCH "https://<nx-witness-host>/rest/v2/system/settings" \
  -u "<admin-user>:<admin-password>" \
  -H "Content-Type: application/json" \
  -d '{"supportedOrigins": "null"}'