CVE-2026-75757: CWE-565 Reliance on Cookies without Validation and Integrity Checking in ash-project ash_admin

The vulnerability in ash_admin involves client-side JavaScript reading state cookies by matching cookie names with an unanchored regular expression against document.cookie. This approach causes any cookie whose name ends with the requested name to match, allowing an attacker who controls a sibling subdomain to set shadowing cookies with a domain attribute covering the main domain. These shadowing cookies can override legitimate session cookies and flow unvalidated into the admin's LiveSocket connection parameters, effectively rebinding the admin session to a different actor, tenant, or authorization mode. The issue affects ash_admin versions from 0.9.1 before 1.3.1. The intended fix is to match cookie names by exact equality rather than using an unanchored regex.

An attacker controlling a sibling subdomain can manipulate the admin's session by injecting shadowing cookies that override legitimate session cookies. This can lead to session rebinding to a different actor, tenant, or authorization mode, potentially allowing unauthorized access or privilege escalation within the ash_admin interface. The vulnerability has a CVSS 4.0 score of 8.3, indicating high severity with network attack vector, low attack complexity, and partial attack traceability.

No official fix or patch is currently confirmed. The vendor advisory does not specify a remediation level or patch availability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability can be mitigated by ensuring cookie name matching uses exact equality rather than unanchored regular expressions to prevent shadowing cookies from sibling subdomains. Until a patch is available, restrict or monitor sibling subdomain control and cookie domain settings to reduce risk.