CVE-2026-75933 Overview
Jet Admin contains a stored cross-site scripting (XSS) vulnerability [CWE-79] in the sign-in page's scripts and styles configuration option. An authenticated attacker can inject arbitrary JavaScript that executes in the browser context of any user visiting the affected sign-in page. The injected script runs on the victim's domain, exposing session tokens, credentials entered on the sign-in form, and any application data accessible to the visiting user.
Critical Impact
Authenticated attackers can persist JavaScript on the Jet Admin sign-in page, harvesting credentials and hijacking sessions of every subsequent visitor to the tenant.
Affected Products
- Jet Admin low-code platform (jetadmin.io)
- Jet Admin sign-in page configuration (scripts and styles option)
- Tenants with attacker-controlled administrative access to sign-in page settings
Discovery Timeline
- 2026-08-21 - CVE-2026-75933 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75933
Vulnerability Analysis
Jet Admin exposes a scripts and styles configuration option on the sign-in page, intended for tenant administrators to add custom branding CSS or analytics tags. The application stores this input verbatim and renders it directly into the sign-in page markup without sanitization or a Content Security Policy that would neutralize inline scripts.
An authenticated user with the ability to modify sign-in page settings can inject arbitrary <script> blocks or event-handler payloads. Because the sign-in page is served under the tenant's own origin, the injected code executes with full access to same-origin resources, cookies, and DOM inputs. Every user who loads the sign-in page—including administrators authenticating from clean sessions—triggers execution of the attacker's payload.
Root Cause
The root cause is improper neutralization of user-supplied input rendered into an HTML context. The scripts and styles field accepts raw markup as a feature, but the application does not distinguish between styling and executable JavaScript, and does not restrict script sources via CSP.
Attack Vector
Exploitation requires network access to the Jet Admin application and low-privilege authenticated access sufficient to edit sign-in page appearance. The attack requires user interaction: a victim must load the sign-in page. The scope is limited to the vulnerable tenant, but impact on confidentiality and integrity of user data within that tenant is high. See the CVE-2026-75933 record and the CISA CSAF advisory for reference details.
The vulnerability is described in prose only; no verified proof-of-concept code has been published.
Detection Methods for CVE-2026-75933
Indicators of Compromise
- Unexpected <script> tags, inline event handlers, or external script src references embedded in the tenant's sign-in page HTML.
- Outbound browser requests from the sign-in page to attacker-controlled domains not present in the organization's approved analytics or CDN list.
- Audit-log entries showing modifications to the sign-in page scripts and styles field by non-administrator or newly created accounts.
Detection Strategies
- Diff the rendered sign-in page HTML against a known-good baseline and alert on any change to inline script or style content.
- Monitor Jet Admin administrative APIs and audit logs for writes to sign-in page branding or customization endpoints.
- Deploy browser-side telemetry or CSP violation reporting to capture script execution originating from unexpected sources on the sign-in page.
Monitoring Recommendations
- Ingest Jet Admin audit logs into a centralized SIEM and build detections on configuration changes to authentication-related pages.
- Alert on authentication anomalies such as session tokens used from new geolocations shortly after sign-in page loads, which may indicate token theft via XSS.
- Review administrator account provisioning and role changes to identify accounts that could reach the vulnerable configuration surface.
How to Mitigate CVE-2026-75933
Immediate Actions Required
- Inspect the sign-in page scripts and styles configuration in each Jet Admin tenant and remove any script content that is not explicitly approved.
- Restrict which roles can edit sign-in page branding to a minimal set of trusted administrators.
- Rotate session cookies and force re-authentication for all users if malicious script content is found on the sign-in page.
Patch Information
No vendor patch identifier is listed in the CVE record at time of publication. Refer to the Jet Admin website and the CISA CSAF advisory for the vendor's current guidance and any fixed release.
Workarounds
- Remove all custom entries from the sign-in page scripts and styles field until a vendor fix is confirmed.
- Enforce a strict Content Security Policy at the edge (reverse proxy or WAF) that blocks inline scripts and restricts script sources on the sign-in page.
- Audit and reduce the number of accounts with permission to modify sign-in page settings, and require multi-factor authentication for those accounts.
# Example: edge CSP header to neutralize inline script injection on the sign-in page
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
