CVE-2026-75932

HighCVSS 8.6

Published: 21/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

Jet Admin allows an attacker to create a malicious app, connect it to a target user's custom domain, edit authentication configuration, and reroute traffic to the attacker-controlled app. If the victim uses an OAuth provider, the attacker obtains the victim's OAuth Client ID and Client Secret.

Risk Assessment

An attacker can take control of the victim's domain and steal OAuth credentials, potentially leading to unauthorized access to user accounts and data.

Recommendation

Upgrade Jet Admin to a version that includes a fix preventing malicious apps from connecting to custom domains and stealing OAuth data.

Other vulnerabilities in Jet Admin

CVE-2026-75933High
Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Original NVD description (English source)

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.