CVE-2026-75932 & CVE-2026-75933: Jet Admin Tenant Isolation Failure and Stored XSS

Overview

Jet Admin contains a tenant isolation failure that allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider. An authenticated attacker could then inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Coordinated Disclosure

Due to the supply-chain risks posed to enterprise internal tooling, this vulnerability was reported through VINCE and coordinated directly by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Despite repeated outreach over an extended period, the vendor remained unresponsive; CISA subsequently published Vulnerability Advisory VA-26-232-02 to warn the Information Technology sector, noting that no fix is currently available.

Description

Jet Admin is a low-code/no-code application development platform designed for building internal business tools, administrative dashboards, and customer-facing portals. It also allows customers to connect a custom domain (e.g., app.company.com) to their workspace so that a built application is served under their own branding. This feature is expected to be scoped per-workspace: only the party that legitimately controls a domain should be able to serve content from it through the platform.

CVE-2026-75932

CVSS v3.1: 8.6 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-862 (Missing Authorization)

Despite the expectation that custom domains remain strictly scoped to their rightful owners, Jet Admin does not enforce this boundary. The platform performs no ownership verification, no DNS TXT challenge, no CNAME-based proof of control before allowing a workspace to claim a domain. Multiple workspaces may claim the same domain simultaneously, and the platform does not surface this conflict to either party.

Upon successfully connecting a domain already in use by another workspace, the claiming workspace's builder interface is immediately populated with the victim workspace's authentication configuration for that domain, including branding, sign-in/sign-up settings, and any configured external OAuth provider's Client ID and Client Secret.

From this position, an attacker is able to:

View and modify the victim's live sign-in and sign-up page content and styling.
View and modify the victim's OAuth configuration.
Reroute traffic to their own app (users logging in or signing up through the victim's domain will be directed to the attacker's workspace).

No interaction from the victim is required at any point in this sequence.

CVE-2026-75933

CVSS v3.1: 7.3 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-79 (Improper Neutralization of Input During Web Page Generation)

A second, independent finding compounds the impact: the custom scripts/styles field on the sign-in page builder does not enforce any type of restrictions, permitting stored XSS. In isolation, this affects only visitors to the attacker's own workspace which is of low real-world value. Chained with the tenant isolation failure above, an attacker can inject this payload into a domain that real, unsuspecting users already trust escalating a self-contained scripting flaw into a credential-harvesting, session-hijacking vector against a legitimate victim's user base.

Impact

CVE-2026-75932 and CVE-2026-75933 enable an attacker to fully compromise a victim organization's public-facing authentication flow and execute arbitrary JavaScript in the context of a trusted domain. By exploiting the tenant isolation failure to capture the victim's OAuth Client Secrets, an attacker can impersonate the victim application to its identity provider, bypass SSO protections, and gain unauthorized access to connected backend databases and APIs. Furthermore, by chaining them together, the attacker can inject XSS payloads into the victim's domain enabling credential harvesting, session hijacking, and full application takeover (if an admin session is hijacked).

Solution

Unfortunately, CISA was unable to reach Jet Admin to coordinate these vulnerabilities.

Until a vendor patch is available, organizations can reduce exposure by disconnecting custom domains from their Jet Admin workspaces and reverting to the platform's default subdomains (*.jetadmin.io). Because the vulnerability requires the domain-claim mechanism to be reachable, removing the custom domain neutralizes the attack surface for this specific vector. Organizations that have previously configured an external OAuth provider with a custom domain on Jet Admin should assume those credentials are compromised and rotate their Client IDs and Client Secrets immediately.

Architectural Remediation (Vendor Recommendations)

To properly resolve these vulnerabilities, Jet Admin must address the underlying tenant isolation and input validation failures at the platform level:

Domain Ownership Verification (CVE-2026-75932): The platform must enforce cryptographic or DNS-based proof of ownership before binding a custom domain to a workspace. Standard industry practice requires users to add a specific TXT record to their DNS configuration or validate a unique CNAME token generated by the platform. Until this challenge is passed, the platform must reject the domain binding.
Enforce Global Domain Uniqueness (CVE-2026-75932): The backend database must enforce a strict uniqueness constraint on custom domains across all workspaces. A single domain should only ever be mapped to one tenant at a time. If a workspace attempts to bind a domain that is already registered to another user, the platform must explicitly reject the request rather than silently allowing overlapping, conflicting claims.
Strict Authorization Scoping: The backend must never populate active authentication configurations (such as OAuth Client Secrets) into a workspace simply because a domain claim was made. Secrets must be strictly tied to the original tenant ID, not the domain string.
Input Sanitization & Sandboxing (CVE-2026-75933): The sign-in page builder must sanitize user-supplied scripts and styles to prevent Stored XSS. Additionally, the platform should implement a robust Content Security Policy (CSP) and execute custom tenant scripts within a sandboxed <iframe> to prevent arbitrary JavaScript from accessing sensitive DOM elements or localStorage tokens.

Acknowledgments

I would like to thank the analysts and coordinators at CERT/CC and CISA for their sustained efforts in managing the Coordinated Vulnerability Disclosure (CVD) process for these findings.

Advisory Details

CVE IDs: CVE-2026-75932, CVE-2026-75933
CISA Advisory ID: VA-26-232-02
Date Public: 2026-08-21
Date First Published: 2026-08-21