CORS Misconfiguration Enables Session Token Theft in Nx Witness

CVE-2026-10056 is a Cross-Origin Resource Sharing (CORS) misconfiguration in Network Optix Nx Witness VMS that allows unauthenticated attackers to steal authenticated user session tokens and achieve Administrator Account Takeover. The vulnerability affects default Standard security mode deployments on both Linux and Windows systems running versions prior to 6.1.2. This is particularly impactful because Nx Witness VMS is widely deployed for video surveillance and security monitoring—systems that require the highest trust levels. An attacker only needs to trick an authenticated administrator into visiting a malicious webpage to compromise the entire video management infrastructure, making this a high-severity supply chain and social engineering vector.

While CVE-2026-10056 currently maps to no specific MITRE ATT&CK techniques in the published advisory, practitioners using Casky.ai would detect the underlying attack patterns through skills aligned with credential access and lateral movement behaviors. Extended reasoning across Casky's 754 mapped security skills would identify suspicious cross-origin API requests, anomalous session token usage from unexpected origins, and authentication bypass attempts typical of T1550 (Use Alternate Authentication Material) and T1187 (Forced Authentication) attack chains. Practitioners reviewing their findings would see API logs showing REST calls originating from mismatched domain sources, session tokens being replayed from unauthorized origins, and privilege escalation attempts immediately following token theft—patterns that Claude's extended reasoning correlates with account takeover attack preparation before administrative actions occur.