CVE-2026-75757: AshAdmin Cookie Reader Vulnerability Leading to Session Shadowing
Summary
CVE-2026-75757: Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash\_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authoriza... Affects ash_admin across 2 version ranges.
>= 0.9.1, < 1.3.1
>= 77a43cc4fa04cb59c38fc434568a35a38ecb995a, < e93a3408a85035e1f90275d02bc2470c96095e56
Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AshAdmin is a component of the Ash framework, designed for building robust web applications. It manages user sessions and permissions through cookies, which store critical information about the user's state, such as tenant and actor details. This vulnerability arises from the way AshAdmin reads cookie names, allowing for potential session hijacking from sibling subdomains.
Vulnerability Detail
The vulnerability in AshAdmin stems from its reliance on cookies without proper validation and integrity checking. The client-side JavaScript uses an unanchored regular expression to match cookie names, which can lead to unintended matches. An attacker controlling a sibling subdomain can create a cookie that shadows an admin's session, allowing them to impersonate the admin or alter their permissions. This could lead to unauthorized access and manipulation of sensitive data.
How To Fix
Latest published version: 1.3.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement server-side validation of cookies to ensure that only expected cookies are processed. This can be done by explicitly checking cookie names before using them in your application logic.
Conclusion
CVE-2026-75757 presents a significant risk to applications using AshAdmin due to improper cookie handling. It is crucial to update to the latest version to protect against potential session hijacking. Implementing server-side validations can serve as a temporary measure until the update is applied.
See every vulnerability recorded for ash_admin →
FAQ
CVE-2026-75757 is a vulnerability in the AshAdmin component of the Ash framework that allows session shadowing due to improper cookie name matching.
If your application uses AshAdmin and is vulnerable, an attacker could hijack admin sessions from sibling subdomains, leading to unauthorized access.
The CVSS score for this vulnerability is 8.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, implement server-side cookie validation as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for ash_admin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
