CVE-2026-10056: Nx Witness VMS CORS Misconfiguration & Session Token Theft

Technical summary

The vulnerability stems from improper CORS configuration where Access-Control-Allow-Credentials is set to true in the default Standard security mode, violating the principle of least privilege for credential exposure. When a user visits a malicious cross-origin page, the browser's same-origin policy is bypassed for credentialed requests, allowing JavaScript running on that page to read the session token from the Nx Witness REST API response. The attacker gains the privileges of the authenticated user, typically administrative access. This is classified under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). The High security mode correctly sets this header to false, preventing the token leak.

Business impact

Compromise of a Nx Witness VMS administrator account grants an attacker full control over video surveillance infrastructure, including the ability to disable recording, delete footage, modify user accounts, and potentially exfiltrate sensitive video data. For organizations relying on VMS for physical security monitoring, facility compliance, or forensic investigation, account takeover poses significant operational and legal risk. The attack requires user interaction but no technical sophistication, making it a credible threat in phishing or watering-hole scenarios targeting VMS operators.

Affected systems

Network Optix Nx Witness VMS versions prior to 6.1.2 running on Linux and Windows in the default Standard security mode are vulnerable. Systems configured with High security mode are not affected. This includes both newly deployed and existing installations unless manually patched or reconfigured.

Exploitability

Exploitation requires moderate complexity: an attacker must create a malicious web page, socially engineer or otherwise induce an authenticated VMS user to visit it, and the victim's browser must have an active authenticated session with the Nx Witness API. The attack is not wormable or self-propagating. However, the barrier to exploitation is low for a determined attacker, and VMS operators may be targeted through phishing or compromised third-party sites.

Remediation

Upgrade Nx Witness VMS to version 6.1.2 or later, which disables credential inclusion in CORS responses by default. For existing installations that cannot be immediately upgraded, apply the temporary workaround by executing a REST API PATCH request to /rest/v2/system/settings with the body {"supportedOrigins": "null"}, which sets Access-Control-Allow-Credentials to false. Alternatively, reconfigure the installation to use High security mode at setup time.

Patch guidance

Download and deploy Nx Witness VMS 6.1.2 or later from Network Optix following the vendor's update procedures. Verify the upgrade completes successfully and confirm that the REST API no longer includes Access-Control-Allow-Credentials: true headers in responses. For air-gapped environments or phased deployments, prioritize systems exposed to untrusted networks. Test patching in a non-production environment first to ensure compatibility with existing integrations and configurations.

Detection guidance

Monitor REST API logs for unusual cross-origin requests (look for Origin headers from unexpected domains) and authentication events from unexpected geographic locations or times. Analyze HTTP response headers to confirm Access-Control-Allow-Credentials is set to false. Alert on rapid session token generation or use of administrator credentials from new IP addresses. Correlate browser security logs from operator workstations for visits to untrusted domains during authenticated VMS sessions. Check system configuration to verify Standard mode systems have the workaround applied or are running version 6.1.2+.

Why prioritize this

This vulnerability warrants high-priority remediation because it enables complete compromise of VMS administrator accounts with minimal attacker effort and moderate user interaction. VMS systems are critical infrastructure for physical security and compliance. The fix is straightforward and non-disruptive. Organizations should prioritize patch deployment or apply the workaround within 30 days, particularly for internet-exposed or frequently-accessed VMS instances.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality and integrity impact (session token and account takeover), network-based attack vector, but higher attack complexity due to the user interaction requirement and the conditional nature of the vulnerability (Standard mode only). The score does not account for the widespread use of VMS in critical security operations, which elevates business risk beyond the base metric.

Frequently asked questions