Description

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-21T16:18:17.873Z",
  "pubdate": "2026-08-21T16:18:17.873Z",
  "executiveSummary": "This vulnerability involves a Stored Cross-Site Scripting (XSS) security flaw identified within the Jet Admin platform. The vulnerability exists due to improper neutralization of user-supplied input within the sign-in page's scripts and styles configuration option. An authenticated attacker possessing administrative or configuration privileges can leverage this functionality to inject arbitrary JavaScript payloads into the application. When successfully exploited, the malicious script executes within the browser context of any visiting user accessing the affected sign-in domain. The potential impact of this vulnerability is severe, as it allows execution of arbitrary script code in the victim's session, potentially leading to unauthorized actions, session hijacking, or credential theft. The risk implications encompass compromised user integrity and potential escalation of unauthorized access across the platform. Exploitation requires prior authentication to access the configuration interface where scripts and styles can be modified, followed by passive or active interaction from visiting users who load the compromised sign-in page. The affected system is Jet Admin, specifically via its administrative customization features handling external script and style injection.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and lack of output encoding within the Jet Admin sign-in page customization interface. Specifically, the component responsible for processing and rendering the scripts and styles option fails to adequately validate or restrict malicious script content provided by users. Consequently, arbitrary JavaScript input is persisted directly into the application backend storage.\nThe vulnerable component resides within the administrative configuration module of Jet Admin that manages visual styles and custom script insertions for the authentication portal. The attack vector requires an authenticated attacker to navigate to the sign-in page configuration settings and inject malicious JavaScript payloads directly into the designated scripts and styles input fields.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the Jet Admin platform with sufficient privileges to modify application branding and sign-in page parameters. Second, the attacker supplies a crafted JavaScript payload disguised as or embedded within the scripts and styles option. Third, the application accepts and stores this input without performing adequate contextual sanitization or enforcing Content Security Policy (CSP) directives that restrict script execution. Fourth, when an unsuspecting user visits the affected sign-in page, the application serves the stored malicious payload to the victim's browser. Finally, the browser executes the injected JavaScript in the context of the user's session and domain, allowing the execution of arbitrary script logic under the victim's origin.\nThe authentication and privilege requirements mandate that the attacker must be authenticated and possess specific authorization to modify the sign-in page configuration. The network exposure is web-based, affecting any user browsing the exposed Jet Admin sign-in interface. The post-exploitation impact includes DOM manipulation, potential session token exfiltration, unauthorized interaction with the application on behalf of the victim, and persistent client-side code execution across visiting client contexts."
}