Skip to main content

Jet Admin EUVDEUVD-2026-63997

| CVE-2026-75932 CRITICAL
Missing Authorization (CWE-862)
2026-08-21 9119a7d8-5eab-497f-8521-727c672e3725 GHSA-cm72-j98h-q99g
Authentication Bypass
9.2
CVSS 4.0 · Vendor: 9119a7d8-5eab-497f-8521-727c672e3725
Share

Severity by source

Vendor (9119a7d8-5eab-497f-8521-727c672e3725) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

No auth needed to create an app and claim another tenant's domain (PR:N, AC:L); scope changes to the victim tenant (S:C); OAuth secret theft is C:H, traffic reroute is A:H, config edit I:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:N/SA:N

Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725).

CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 21, 2026 - 16:35 vuln.today
CVE Published
Aug 21, 2026 - 16:18 cve.org
CRITICAL 9.2

DescriptionCVE.org

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.

Articles & Coverage 1

medium.com CVE-2026-75932 & CVE-2026-75933: Jet Admin Tenant Isolation Bypass and Stored XSS Allow Cross-Tenant Data Access Aug 25, 2026

AnalysisAI

Domain and OAuth-credential hijacking in the Jet Admin no-code internal-tools platform lets a remote attacker create their own malicious app, bind it to a victim's configured custom domain, alter the authentication configuration, and silently reroute the victim's traffic to attacker-controlled logic. Because the takeover also copies the victim's OAuth Client ID and Client Secret into the attacker's workspace, it doubles as a credential-theft primitive against any tenant using an OAuth identity provider. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Register attacker Jet Admin workspace
Delivery
Build malicious app
Exploit
Bind app to victim custom domain
Execution
Edit domain auth configuration
Impact
Reroute victim traffic and harvest OAuth Client ID/Secret
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target organization has configured a custom domain in Jet Admin, and the OAuth-credential-theft consequence specifically requires that the victim tenant uses an OAuth provider for authentication - a tenant with no custom domain or no OAuth configured is not exposed to the full impact. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals point to a genuinely high-priority, low-friction issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a Jet Admin workspace, builds a malicious app, and binds it to a target organization's custom domain, then edits that domain's authentication configuration to reroute incoming users to attacker-controlled logic. End users visiting the legitimate domain are served the attacker's app, and the attacker's workspace is automatically populated with the victim's OAuth Client ID and Client Secret; no POC is publicly referenced, but the described steps require only standard platform features.
Remediation No vendor-released patch version is identified in the available data, and as a hosted platform the fix is expected to be applied server-side by Jet Admin rather than via a customer upgrade; consult the CISA CSAF advisory (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-232-02.json) and the vendor at https://www.jetadmin.io/ for authoritative status. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all internal applications and workflows deployed on Jet Admin and identify those handling sensitive data or integrated with OAuth providers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-63997 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy