In AshAdmin the client code reads state cookies by matching cookie names with an unanchored regular expression. Because the match succeeds on any name that ends with the target string and the first matching cookie is used, an attacker who controls a sibling subdomain can create a shadowing cookie that shares the registrable domain and causes the admin user's session to be bound to a malicious actor, tenant, or authorization mode. This allows unauthorized access to privileged resources, effectively providing session hijacking and potential privilege escalation. The vulnerability is an example of improper input validation (CWE‑565).

ash‑project's AshAdmin web application, from version 0.9.1 up to, but not including, 1.3.1.

CVSS 8.3 indicates a high severity flaw. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to control a domain that can set cookies shared with the admin application; once the attacker sets a cookie whose name ends with a valid AshAdmin cookie name and the domain attribute covers the registrable domain, the client will read it and bind the session to the malicious context. This yields the ability to act with the privileges of the admin when the session is used in subsequent LiveSocket connections. The vulnerability is exploitable in environments where subdomain control is possible and the client‑side cookie parsing is performed without strict name matching.