The ash_admin library is vulnerable to a critical session hijacking flaw that permits attackers to impersonate administrators or alter authorization modes by exploiting improper cookie name matching.

This is a reliance on cookies without validation and integrity checking (CWE-565). The client-side JavaScript uses an unanchored regular expression to parse cookies, allowing an attacker to override sensitive session state via a malicious cookie set on a shared registrable domain.

The vulnerability carries a CVSS score of 8.3, indicating a high level of risk. A successful exploit allows unauthorized actors to rebind an administrator session to a different tenant or actor, potentially leading to full administrative account takeover, unauthorized data access, and the bypass of critical security controls within the application.

Immediate Action: Update the ash_admin dependency to version 1.3.1 or later, which implements exact equality matching for cookie names to prevent shadowing.

Proactive Monitoring: Review application logs for unusual session activity or authentication requests originating from unexpected subdomains.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and ensure that cookies are scoped to the narrowest possible domain, preventing cross-subdomain cookie leakage.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete administrative session compromise, organizations utilizing ash_admin must prioritize this update. The ease of exploitation via sibling domain control necessitates immediate patching to ensure the integrity of the administration interface and its associated actor permissions.