EUVD-2026-68324Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required sibling subdomain compromise prerequisite; VI:H from session rebinding; VC:L from incidental cookie value exposure; no authentication needed on AshAdmin itself.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.
AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.
This issue affects ash_admin: from 0.9.1 before 1.3.1.
AnalysisAI
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used new RegExp(name + "=([^;]+)"), which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., xactor_authorizing over actor_authorizing) set from a sibling subdomain with Domain=.example.com to silently win. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control at least one sibling subdomain sharing the same registrable domain as the AshAdmin instance (e.g., both `evil.example.com` and `admin.example.com` under `example.com`). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 with AT:P (attack requirements present) correctly captures the critical precondition: the attacker must already control a sibling subdomain sharing the same registrable domain as the AshAdmin deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_admin to version 1.3.1 or later, which resolves the issue via commit e93a3408a85035e1f90275d02bc2470c96095e56 - replacing the unanchored regex cookie parser with exact-equality name matching. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enablin
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin in
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and st
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolatio
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today