AshAdmin CVE-2026-75757

Exploitation requires that the attacker control at least one sibling subdomain sharing the same registrable domain as the AshAdmin instance (e.g., both evil.example.com and admin.example.com under example.com). The compromised subdomain must be able to set cookies with a broad Domain=.example.com scope - standard browser behavior for any response originating from a subdomain. AshAdmin must be running versions 0.9.1 through 1.3.0. An administrator must have an active browser session on the AshAdmin instance (their browser must carry the legitimate AshAdmin state cookies). Exploitation is limited by: (1) the sibling subdomain prerequisite - subdomain takeover or compromise is not trivial and requires a separate vulnerability; (2) the administrator must visit AshAdmin while the injected cookies are present in their browser; (3) the attack is constrained to browsers where both the sibling subdomain and AshAdmin share cookie scope. Organizations serving AshAdmin on an isolated registrable domain (no shared apex domain with other properties) are not exploitable.

The CVSS 4.0 score of 8.3 with AT:P (attack requirements present) correctly captures the critical precondition: the attacker must already control a sibling subdomain sharing the same registrable domain as the AshAdmin deployment. This prerequisite meaningfully raises the bar - blind internet scanning cannot trigger this vulnerability. However, once a sibling subdomain is compromised (via a separate XSS, misconfigured S3 bucket with a CNAME, or subdomain takeover), exploitation of this cookie shadowing is trivial and fully automated: inject cookies via a simple HTTP response from the controlled subdomain. The VI:H rating is well-justified - an attacker can pause authorization (actor_paused), spoof an arbitrary actor identity (actor_primary_key, actor_resource), or switch tenants, effectively operating as any user without valid credentials in the admin panel. The VC:L component reflects that attacker-controlled cookie names may inadvertently expose or overwrite legitimate cookie values visible in document.cookie. No EPSS score was provided in the input, so exploitation probability cannot be numerically assessed. No public POC or KEV listing exists, suggesting limited opportunistic exploitation to date. Real-world priority is high for any organization running AshAdmin on a shared domain with multiple subdomains (common in SaaS and multi-tenant deployments); low for isolated single-domain deployments.

An attacker identifies a subdomain takeover opportunity on static.example.com (a dangling CNAME to an unclaimed S3 bucket) while the target runs AshAdmin at admin.example.com. The attacker claims the bucket and serves a page that sets xactor_authorizing=false; Domain=.example.com; Path=/ and xactor_paused=true; Domain=.example.com; Path=/ via document.cookie. When any administrator subsequently opens AshAdmin in the same browser, the unanchored regex resolves the attacker's cookies first, disabling authorization checks and pausing actor validation in the LiveSocket session - granting the attacker the ability to operate as an arbitrary actor through the admin's active session. No public POC is available at time of analysis, but the technique requires only basic JavaScript knowledge.