User impersonation via static enrollment authentication token

Improper authentication in the Netskope Client enrollment process allows remote attackers with a leaked Orgkey to impersonate a user. NSClient accepts the tenant's static Orgkey as the enrollment authentication parameter, so possession of the non-rotatable token is treated as authorization. Exploitation requires disclosure of the Orgkey and permits unauthorized client enrollment under the customer tenant with user impersonation.