CVE-2026-75757
Received Received - Intake

Session Fixation in AshAdmin via Unvalidated Cookies

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality. This issue affects ash_admin: from 0.9.1 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-75757
EUVD
EUVD-2026-68324

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_admin From 0.9.1 (inc) to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper cookie handling in the ash_admin library. The JavaScript client uses an unanchored regular expression to read cookies, which matches cookie names by substring rather than exact equality. This allows an attacker controlling a sibling subdomain to set a shadowing cookie that overrides legitimate session cookies, rebinding the admin's session to a different actor, tenant, or authorization mode.

Detection Guidance

Check if your ash_admin version is between 0.9.1 and 1.3.0. Inspect JavaScript files (assets/js/app.js, priv/static/assets/app.js) for regex-based cookie name matching like new RegExp(name + "=([^;]+)"). Look for cookies with names ending in target names (e.g., xactor_authorizing).

Commands: grep -r "RegExp.*cookie" /path/to/app.js; curl -s http://yourdomain.com/assets/app.js | grep -i "regexp"

Impact Analysis

An attacker could hijack an admin's session, allowing them to impersonate the admin, access unauthorized data, or perform actions with elevated privileges. This could lead to data breaches, unauthorized modifications, or system compromise if the admin has high-level access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade ash_admin to version 1.3.1 or later. Replace regex-based cookie matching with exact name matching in JavaScript files. Ensure no sibling subdomains are compromised.

If upgrading is not possible, review and remove any cookies with names ending in ash_admin state cookie names (tenant, actor_resource, etc.) from sibling subdomains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart