CVE-2026-75932

Jet Admin's custom domain handling contains a trust boundary violation that merits attention beyond its CVSS score. The platform verified domain ownership when users initially configured custom domains, then trusted that prior verification to authorize future connections by any app in the workspace. This meant an attacker who could claim a domain previously configured by another workspace member could intercept OAuth flows and capture client credentials intended for the legitimate application. The mechanism is straightforward in hindsight: domain verification was treated as a one-time gate rather than a continuous authorization context. Once a domain passed ownership verification, the platform allowed any workspace application to bind to it without re-confirming that the current binding request came from the same entity that proved ownership. This separated identity (who owns this domain) from authorization (who can attach resources to this domain) — a classic mistake in multi-tenant SaaS that recurs because verification feels 'complete' once passed. For defenders, the actionable items are: first, audit any custom domain feature in your multi-tenant platform by checking whether domain ownership verification is re-challenged at binding time, not just at configuration time — this is the specific control gap to test. Second, treat domain-to-app mappings as privileged operations that require current authentication context, not stale verification state. Third, review OAuth credential usage across your platform; while credential scoping is provider-dependent, the architectural lesson is that domain hijacking creates credential exposure even when credentials themselves aren't stolen. This pattern — verify-once, trust-forever — has appeared in other platforms handling custom domains. The recurrence suggests it results from treating domain configuration as a solved problem rather than a living authorization boundary that must evolve with the platform's architecture. The fix in Jet Admin addresses this instance, but the structural pressure to make domain configuration 'just work' means similar gaps likely exist elsewhere.

Reviewed through automated stages and approved by a human before publication.