EEF-CVE-2026-75757 CVE-2026-75757 GHSA-3259-55fp-w94j
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.52%
- Chance of exploitation in the next 30 days. Higher than 44.44% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
- Fix
1.3.1- Upgrade ash_admin to this version or later
Description
Summary
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.
AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.
This issue affects ash_admin: from 0.9.1 before 1.3.1.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_admin | >= 0.9.1, < 1.3.1 |
1.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_admin Hex → 1.3.1
- mix
{:ash_admin, "~> 1.3.1"} # then: mix deps.update ash_admin
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
How to prevent it
- Architecture and Design: Avoid using cookie data for a security-related decision.
- Implementation: Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
- Architecture and Design: Add integrity checks to detect tampering.
- Architecture and Design: Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-82722 AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) | Not rated yet | Also affects ash_admin |
| GHSA-gx76-c99x-2c96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | Low | Same weakness, CWE-565 |
| GHSA-8c7c-h7px-267g Concrete CMS is vulnerable to IDOR in surveys | Medium | Same weakness, CWE-565 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor