Description

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-21T16:18:17.717Z",
  "pubdate": "2026-08-21T16:18:17.717Z",
  "executiveSummary": "This security analysis evaluates a critical vulnerability within Jet Admin that permits malicious actors to execute domain hijacking and credential exposure. The vulnerability allows an unauthorized attacker to craft a malicious application within the Jet Admin ecosystem and forcibly bind it to a target victim's custom domain.\nBy manipulating the authentication configuration and rerouting inbound traffic, the attacker successfully intercepts application traffic destined for the legitimate domain and directs it to the attacker-controlled workspace.\nThe primary impact of this flaw is the unauthorized disclosure of sensitive authentication material. Specifically, once the target domain is successfully bound to the attacker's malicious application, the attacker's workspace is automatically populated with the victim's confidential OAuth Client ID and Client Secret if the victim utilizes an OAuth provider for authentication.\nThis compromises the confidentiality and integrity of the target organization's authentication infrastructure, enabling subsequent unauthorized access and potential administrative compromise.\nThe risk implications are severe, as stolen OAuth credentials allow attackers to impersonate legitimate applications and access connected third-party services on behalf of the victim. Exploitation requires the attacker to possess the capability to create applications within Jet Admin and leverage improper domain validation or authorization logic in the target system.",
  "technicalDetails": "The vulnerability resides in the custom domain binding and workspace configuration logic of Jet Admin. The root cause stems from insufficient validation and authorization checks when associating a custom domain with a Jet Admin application, allowing domain takeover conditions to occur across tenant boundaries.\nThe exploitation method involves the attacker initiating the creation of a rogue application within their own Jet Admin workspace. During or after application creation, the attacker supplies the target user's custom domain during the domain configuration phase. Due to the lack of adequate ownership verification or domain validation mechanisms (such as cryptographic challenge-response tokens or DNS TXT record verification), the system permits the attacker to complete the custom domain association.\nOnce the custom domain is successfully hijacked, the attacker modifies the authentication configuration within the rogue application to intercept traffic. When users attempt to access the legitimate custom domain, the HTTP requests and routing mechanisms reroute the traffic directly to the attacker-controlled application instance.\nThe post-exploitation phase involves the leakage of sensitive environment parameters. If the targeted organization utilizes an OAuth provider for authentication, the system automatically exposes and populates the victim's OAuth Client ID and Client Secret into the attacker-controlled workspace interface. This occurs because the application runtime or configuration provisioning mechanism shares or leaks environment secrets associated with the context of the requested domain or application binding.\nThe vulnerable components include the domain management subsystem, the routing engine, and the tenant isolation boundary logic of Jet Admin. The attack requires network exposure of the Jet Admin application management interface, authentication within the platform to create a baseline application, and standard network access to resolve and traffic-route via the target custom domain. No prior privileged access to the victim's workspace is required, making this an external domain hijacking and information disclosure vector."
}