CVE-2026-75932 in Jet Admin
Summary
by MITRE • 08/21/2026
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability in Jet Admin represents a critical failure in identity management and access control mechanisms, specifically within the context of custom domain configurations and authentication workflows. This flaw allows an attacker to exploit the trust relationship between the application platform and user-defined domains to hijack administrative privileges or intercept sensitive credentials. The core technical issue stems from insufficient validation during the process of associating a malicious application with a target user's custom domain. By leveraging this misconfiguration, an adversary can effectively bypass standard authentication barriers that are typically designed to prevent unauthorized access to organizational resources.
The operational sequence begins when an attacker creates a malicious application within the Jet Admin environment and initiates a connection request using a victim organization's custom domain as part of the configuration process. Because the platform fails to adequately verify ownership or authorization for this specific association, the system accepts the link between the attacker-controlled app and the legitimate domain. Once this connection is established, the attacker gains the ability to modify authentication settings associated with that domain. This modification capability is particularly dangerous because it allows the redirection of traffic from the intended service to an endpoint controlled by the adversary.
A significant consequence of this vulnerability involves the exposure of OAuth credentials. When a victim organization utilizes an OAuth provider for single sign-on or API access, Jet Admin stores sensitive identifiers such as the Client ID and Client Secret within the workspace configuration linked to that domain. Upon successfully connecting their malicious app to the target domain, the attacker's workspace is automatically populated with these high-value secrets. This exposure grants the adversary full ability to impersonate the victim application in interactions with the OAuth provider, potentially leading to unauthorized access to user accounts, data exfiltration, or further lateral movement within the affected infrastructure.
From a classification perspective, this vulnerability aligns closely with CWE-287, which describes Improper Authentication, as well as CWE-613, Insufficient Session Expiration, depending on how long the malicious connection persists without revocation. Furthermore, in terms of attack tactics, this scenario maps to MITRE ATT&CK technique T1098, specifically Account Manipulation or SSH Hijacking variants where an attacker alters account properties to maintain access. The ability to reroute traffic also touches upon aspects of supply chain compromise and identity-based attacks, highlighting the severity of misconfigurations in cloud-native administrative tools.
Mitigation strategies must focus on strict validation of domain ownership before allowing any application associations. Administrators should implement multi-factor authentication for all Jet Admin accounts and enforce least-privilege principles to limit who can modify authentication configurations or connect external applications. Regular audits of connected apps and custom domains are essential to detect unauthorized associations early. Additionally, organizations should rotate OAuth client secrets periodically and monitor for unusual activity in their identity provider logs, such as unexpected token issuance from unfamiliar clients. Ensuring that the platform requires explicit confirmation steps for high-risk configuration changes can also reduce the risk of exploitation through social engineering or automated attacks.