CVE-2026-75757: ash_admin Authentication Bypass Vulnerability

CVE-2026-75757 Overview

CVE-2026-75757 is a session rebinding vulnerability in ash_admin, the administrative interface for the Ash Framework in Elixir. The flaw stems from reliance on cookies without validation and integrity checking [CWE-565]. AshAdmin's client JavaScript parsed state cookies using an unanchored regular expression, allowing any cookie whose name ends with the target string to match. An attacker who controls a sibling subdomain can set a shadowing cookie with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect parameters. This lets the attacker rebind an admin's session to a different actor, tenant, or authorization mode. The vulnerability affects ash_admin from version 0.9.1 before 1.3.1.

Critical Impact

A compromised sibling subdomain can shadow AshAdmin session cookies and silently rebind an authenticated administrator to an attacker-chosen actor, tenant, or authorization context.

Affected Products

• ash_admin versions 0.9.1 through 1.3.0
• Elixir applications embedding AshAdmin LiveView routes
• Deployments sharing a registrable domain with other subdomains

Discovery Timeline

• 2026-08-31 - CVE-2026-75757 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75757

Vulnerability Analysis

AshAdmin relies on browser cookies to transport admin session state to the LiveView socket. The client reads cookies named tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, and actor_paused. The values are passed into the LiveSocket connect parameters without server-side integrity verification. Because the reader used an unanchored regular expression, cookie name matching was performed as a substring suffix match rather than an exact equality check. This design assumption breaks whenever a related subdomain can set cookies scoped to the parent registrable domain.

Root Cause

The getCookie helper constructed new RegExp(name + "=([^;]+)") and executed it against the entire document.cookie string. The pattern is unanchored, so a cookie named xactor_authorizing matches a lookup for actor_authorizing. When multiple cookies match, whichever is serialized first by the browser wins. The client then forwards the attacker-controlled value into LiveSocket parameters, and the server accepts it as authoritative admin session state.

Attack Vector

An attacker who compromises or registers content on a sibling subdomain of the AshAdmin host sets a shadowing cookie with Domain=.example.com. Browsers merge that cookie into requests toward the admin subdomain. When an authenticated administrator loads AshAdmin, the client-side reader returns the attacker's value instead of the legitimate cookie. The LiveSocket then binds the session to an attacker-chosen actor, tenant, or authorization mode.

// Vulnerable pattern removed in the patch
// Source: https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56
function getCookie(name) {
  var re = new RegExp(name + "=([^;]+)");
  var value = re.exec(document.cookie);
  if (value == null) return null;
  var decoded = decodeURIComponent(value[1]);
  return decoded === "null" || decoded === "undefined" ? null : decoded;
}

Detection Methods for CVE-2026-75757

Indicators of Compromise

• Unexpected cookies on the admin host with names ending in actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused, or tenant.
• Set-Cookie responses from sibling subdomains using Domain= scoped to the registrable parent domain.
• LiveSocket connect parameters containing actor identifiers or tenant values that do not match server-side session records.

Detection Strategies

• Audit HTTP response logs across all subdomains sharing the registrable domain for Set-Cookie headers referencing AshAdmin state names.
• Compare LiveView phx-join payload values (actor_*, tenant) against the server's authenticated user context and alert on mismatches.
• Inventory deployed ash_admin versions across environments and flag any instance older than 1.3.1.

Monitoring Recommendations

• Alert on admin actions performed by actors that do not match the authenticated session identity recorded server side.
• Monitor for anomalous tenant switches or authorization toggles originating from LiveSocket connect parameters.
• Track content changes and new hostnames on sibling subdomains hosting user-controlled content.

How to Mitigate CVE-2026-75757

Immediate Actions Required

• Upgrade ash_admin to version 1.3.1 or later across every environment that exposes admin routes.
• Rotate admin sessions and invalidate outstanding LiveSocket sessions after upgrading.
• Review all sibling subdomains for the ability to set cookies with a parent-domain scope and remove that capability where possible.

Patch Information

The fix replaces the unanchored regular expression with exact string equality on the cookie name. Details are available in the GitHub Security Advisory GHSA-3259-55fp-w94j and the upstream patch commit.

// Patched getCookie implementation in assets/js/app.js
// Source: https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56
function getCookie(name) {
  // Match the cookie name by exact equality. An unanchored regex would let a
  // cookie whose name merely ends with `name` (e.g. `xactor_authorizing`,
  // settable from a sibling subdomain) shadow the real one.
  var cookies = document.cookie ? document.cookie.split("; ") : [];
  for (var i = 0; i < cookies.length; i++) {
    var eq = cookies[i].indexOf("=");
    if (eq === -1) continue;
    if (cookies[i].slice(0, eq) === name) {
      var decoded = decodeURIComponent(cookies[i].slice(eq + 1));
      return decoded === "null" || decoded === "undefined" ? null : decoded;
    }
  }
  return null;
}

Workarounds

• Host AshAdmin on a dedicated registrable domain that does not share cookie scope with any other application.
• Prefix admin cookies with __Host- and set Domain attributes narrowly so sibling subdomains cannot override them.
• Enforce server-side validation that the actor_* and tenant values from LiveSocket parameters match the authenticated session before honoring them.

# Update the dependency in mix.exs and fetch the fixed release
# {:ash_admin, "~> 1.3.1"}
mix deps.update ash_admin
mix deps.get
mix compile