Cardiff looked destined to keep their slim hopes of a top-six finish alive thanks to Joe Ledley’s stunning second-half equaliser.
But Cardiff defender Glenn Loovens was adjudged to have brought down Marcus Williams and Hayes coolly converted his last-gasp spot-kick.
Cardiff’s FA Cup hero Ledley served up another fine goal to haul Cardiff level after Scunthorpe had struck twice in three minutes early in the second half.
Jimmy Floyd Hasselbaink (45) had marked his return to Cardiff’s side with a trademark drive.
Scunthorpe then turned the game on its head with goals from Paul Hayes (56) and Kevan Hurst (56), before Ledley’s rocket brought the Welshmen level.
But two-goal Hayes had the last laugh.