CVE-2026-75932 Overview
CVE-2026-75932 is a missing authorization flaw [CWE-862] in Jet Admin, a low-code internal tools platform. An attacker can create a malicious application and attach it to another tenant's custom domain without authorization checks. After binding the domain, the attacker edits the authentication configuration and reroutes traffic to the attacker-controlled workspace. When the legitimate tenant uses an OAuth provider, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret, exposing federated identity credentials.
Critical Impact
Attackers can hijack a victim's custom domain in Jet Admin, harvest OAuth Client ID and Client Secret values, and impersonate authenticated users across integrated identity providers.
Affected Products
- Jet Admin (jetadmin.io) low-code application platform
- Jet Admin workspaces configured with custom domains
- Jet Admin tenants using OAuth-based authentication providers
Discovery Timeline
- 2026-08-21 - CVE-2026-75932 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75932
Vulnerability Analysis
The vulnerability is a missing authorization check on the custom domain binding workflow in Jet Admin. The platform does not verify that the caller owns the target domain before accepting a new application-to-domain association. An attacker registers a Jet Admin account, creates a new app, and requests to attach that app to a domain already claimed by a victim tenant.
Because the authorization gate is absent, the attacker's app becomes the authoritative handler for the victim's custom domain. The attacker then modifies the authentication configuration on the hijacked domain. If the victim relies on an OAuth identity provider, the platform propagates the victim's OAuth Client ID and Client Secret into the attacker's workspace, granting the attacker the ability to impersonate the victim's OAuth application.
Root Cause
The root cause is an authorization gap on the custom domain association API. The service treats domain claims as a self-service operation without validating that the requesting workspace owns the domain, controls the DNS record, or has previously been associated with it. This aligns with the CWE-862 pattern of missing authorization on privileged state-changing operations.
Attack Vector
The attack is fully remote and requires no privileges or user interaction on the victim side. An attacker with a free Jet Admin tenant issues API or UI requests to bind their malicious app to the victim's domain, then edits authentication settings. Traffic that resolves to the domain, including OAuth callbacks, is routed to the attacker's workspace. The attacker extracts the victim's OAuth Client ID and Client Secret from the workspace configuration.
No verified proof-of-concept code has been published. See the CISA CSAF Vulnerability Report and the CVE-2026-75932 Record for authoritative technical details.
Detection Methods for CVE-2026-75932
Indicators of Compromise
- Unexpected changes to custom domain assignments in Jet Admin workspace audit logs.
- New Jet Admin applications created by unfamiliar accounts that reference a production domain.
- OAuth provider logs showing token issuance or callback traffic originating from workspaces the organization does not operate.
- Sudden authentication configuration edits, especially changes to OAuth redirect URIs or client metadata.
Detection Strategies
- Monitor Jet Admin audit events for domain binding, unbinding, and authentication configuration changes and correlate them with authorized change tickets.
- Alert on OAuth provider events where the Client ID associated with the Jet Admin app is used from unexpected IP ranges, regions, or user agents.
- Track DNS records for Jet Admin custom domains and flag CNAME or verification-record drift.
Monitoring Recommendations
- Ingest Jet Admin administrative logs and OAuth provider logs into a centralized analytics platform for cross-source correlation.
- Establish a baseline of legitimate Jet Admin workspaces and applications and alert on new external tenants referencing owned domains.
- Review OAuth Client Secret usage regularly and rotate secrets on any suspicion of exposure.
How to Mitigate CVE-2026-75932
Immediate Actions Required
- Confirm ownership and current binding of every custom domain in Jet Admin and remove any unrecognized application associations.
- Rotate OAuth Client Secrets for any identity provider integrated with Jet Admin, and rotate Client IDs where the provider supports it.
- Review OAuth provider logs for token issuance during the exposure window and revoke suspicious sessions and refresh tokens.
- Contact Jet Admin support to confirm remediation status and request tenant-level audit data.
Patch Information
No vendor patch reference is available in the enriched CVE data. Consult the JetAdmin Security Overview and the CISA CSAF Vulnerability Report for the most current vendor guidance and fix availability.
Workarounds
- Restrict Jet Admin custom domains to those actively required, and unbind unused domains to reduce the attack surface.
- Constrain OAuth application redirect URIs at the identity provider so that only known Jet Admin endpoints can complete authorization flows.
- Enforce short-lived OAuth tokens and require step-up authentication for administrative changes to Jet Admin workspaces.
- Where feasible, front Jet Admin with an identity-aware proxy that validates tenant ownership independently of the platform.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
