CVE-2026-75757

AshAdmin, the admin UI for the Elixir Ash framework, parses its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) with an unanchored regular expression, so any cookie whose name merely ends with the expected name is accepted. Because cookies are shared across a registrable domain, an attacker who controls or compromises a sibling subdomain can plant a shadowing cookie (for example xactor_authorizing) with Domain=.example.com. That cookie is matched first by the AshAdmin client JavaScript and flows, unvalidated, into the LiveSocket connect params, allowing the attacker to rebind an authenticated admin's session to a different actor, tenant, or authorization mode. Installations running ash_admin from 0.9.1 through any version before 1.3.1 are affected, particularly those hosted on a subdomain that shares its registrable domain with attacker-influenceable subdomains. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.3% probability of exploitation within the next 30 days.

What to do: Upgrade ash_admin to 1.3.1 or later, which matches cookie names by exact equality. As interim mitigation, ensure no untrusted or attacker-controllable subdomains share the registrable domain of the AshAdmin host, and audit existing cookies (e.g., names ending in the AshAdmin state-cookie names) set with a broad Domain attribute. The attack requires sibling-subdomain control, so review which third parties or tenants can set cookies on your registrable domain.