CVE-2026-75932: Jet Admin tenant isolation failure
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using Jet Admin custom domains are exposed. The risk is especially significant for tenants that use an OAuth provider, because the attacker’s workspace can receive the victim’s OAuth Client ID and Client Secret after the domain is connected.
What does an attacker need to exploit it?
The attacker needs the ability to create a malicious Jet Admin app and connect it to a target user’s custom domain. The reported attack does not require prior privileges or user interaction.
What is the potential impact after exploitation?
An attacker can alter authentication configuration and reroute traffic for the target custom domain to an attacker-controlled app. If OAuth is in use, the attacker may obtain the victim tenant’s OAuth client credentials.