{"id":"CVE-2026-75757","aliases":["EEF-CVE-2026-75757","EUVD-2026-68324","GHSA-3259-55fp-w94j"],"status":"published","title":"AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain","description":"Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.\n\nAshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00524,"percentile":0.44883,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-565"],"published":"2026-08-31T02:20:17Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Hex","package":"ash_admin","fixed_in":["1.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_admin","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.1"},{"fixed":"1.3.1"}]}],"versions":["0.10.0","0.10.1","0.10.10","0.10.10-rc.0","0.10.10-rc.1","0.10.11","0.10.12","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.11.1","0.11.10","0.11.11","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.11.9","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.1","0.13.10","0.13.11","0.13.12","0.13.13","0.13.14","0.13.15","0.13.16","0.13.17","0.13.18","0.13.19","0.13.2","0.13.20","0.13.21","0.13.22","0.13.23","0.13.24","0.13.25","0.13.26","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.9","0.14.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","1.0.0-rc.0","1.1.0","1.2.0","1.3.0"]}],"products":[{"vendor":"ash-project","product":"ash_admin"}],"references":[{"url":"https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-75757.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-75757","tags":["related","web"]},{"url":"https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75757.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75757","tags":["advisory"]},{"url":"https://github.com/ash-project/ash_admin","tags":["package"]},{"url":"https://hex.pm/packages/ash_admin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-75757","title":"AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain","description":"Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.\n\nAshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1.","status":"published","published":"2026-08-31T02:20:17.985Z","modified":"2026-08-31T14:50:59.043Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-68324","description":"Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.\n\nAshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1.","status":"published","published":"2026-08-31T02:20:17Z","modified":"2026-08-31T14:50:59Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:21.100116Z"}],"nvd":[{"id":"CVE-2026-75757","description":"Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.\n\nAshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1.","status":"published","published":"2026-08-31T03:16:42.133Z","modified":"2026-09-01T21:15:00.147Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-75757","title":"AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain","description":"Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.\n\nAshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1.","status":"published","published":"2026-08-31T02:20:17.985Z","modified":"2026-10-28T02:30:29.196026837Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"EEF-CVE-2026-75757","title":"AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain","description":"## Summary\n\nReliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.\n\nAshAdmin's client JavaScript read its state cookies (`tenant`, `actor_resource`, `actor_primary_key`, `actor_action`, `actor_domain`, `actor_authorizing`, `actor_paused`) by matching the cookie name with an unanchored regular expression (`new RegExp(name + \"=([^;]+)\")`) against the whole `document.cookie`. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example `xactor_authorizing`) with `Domain=.example.com` that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1.","status":"published","published":"2026-08-31T02:20:17.985Z","modified":"2026-09-08T03:30:11.37820751Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}