Jet Admin’s tenant isolation flaw allows an attacker to create a malicious app, link it to a victim’s custom domain, modify the authentication configuration, and redirect traffic to the attacker’s app. When the malicious app is connected, the victim’s OAuth client ID and client secret are automatically copied into the attacker’s workspace, enabling credential theft and the possibility of impersonating the victim with those OAuth credentials.

All Jet Admin installations, regardless of version, that use custom domain support and OAuth authentication. No specific version entailed, so all current/previous releases may be affected.

The vulnerability has a CVSS score of 9.2, indicating a high severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to have an account in Jet Admin to create a malicious app and must target a user who has linked a custom domain. If those prerequisites are met, the attack can be performed with no additional user interaction and results in full theft of OAuth credentials.