Summary
CVE-2026-75932 is a missing authorization (CWE-862) vulnerability in Jet Admin that breaks tenant isolation between customer workspaces. An attacker can create a malicious Jet Admin app, connect it to a victim’s custom domain, and reroute traffic to the attacker-controlled app, ultimately capturing the victim’s OAuth Client ID and Client Secret. The issue carries a CVSS v4.0 base score of 9.2 (Critical) and affects all versions of Jet Admin.
Technical details
- Root cause: Jet Admin fails to properly verify ownership/authorization when a workspace is connected to a custom domain, allowing an attacker’s workspace to be associated with a domain it does not own.
- Trigger conditions: An attacker registers a Jet Admin app/workspace and connects it to a target user’s custom domain, then edits the authentication configuration for that domain.
- Attack vector: Network — no special privileges or user interaction from the victim are required to establish the malicious connection; the attacker abuses the custom-domain linking and authentication configuration workflow.
- Impact: Traffic intended for the victim’s custom domain is rerouted to the attacker-controlled app. If the victim uses an OAuth identity provider, the attacker’s workspace becomes populated with the victim’s OAuth Client ID and Client Secret, enabling further account/identity compromise.
Affected software
- Jet Admin — all versions (no version-specific fix identified; affects the platform as a whole, version 0 and above).
Severity
- CVSS v4.0: 9.2 (Critical) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:N/SA:N - CVSS v3.1: 8.6 (High) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Mitigation and recommended actions
- Immediate: No vendor-published patched version has been identified as of this writing; monitor Jet Admin’s official channels for an update and apply it as soon as it is released.
- Workarounds:
- Audit all custom domains connected to your Jet Admin workspace and remove/verify any unrecognized or unauthorized domain-to-app associations.
- Review and rotate OAuth Client ID/Secret values for any identity provider integrated with Jet Admin, particularly if a custom domain connection cannot be fully verified as trusted.
- Restrict who can create or modify custom domain and authentication configuration settings within the Jet Admin workspace.
- Monitor authentication configuration change logs for unexpected modifications tied to domain connections.

