Jet Admin is vulnerable to an authorization bypass that allows attackers to hijack traffic and redirect users to malicious, attacker-controlled applications.

This is a missing authorization vulnerability (CWE-862). It allows an unauthenticated attacker to manipulate the authentication configuration of a target user's custom domain to reroute traffic to a malicious application.

The CVSS score of 8.6 reflects the high potential for session hijacking, credential theft, and data interception. Successful exploitation could lead to significant reputational damage and the compromise of user-sensitive data flowing through the affected domain.

Immediate Action: Review vendor security bulletins for available patches or configuration changes to restrict domain application linking.

Proactive Monitoring: Monitor custom domain configurations and authentication settings for unauthorized modifications or unexpected application associations.

Compensating Controls: Implement strict monitoring of traffic patterns and ensure that any external integrations are validated against known, trusted application identifiers.

Public Exploit Available: Unknown

The ability for an attacker to hijack traffic via domain configuration manipulation necessitates urgent attention. Organizations should evaluate their exposure and monitor for any suspicious changes to their Jet Admin application settings while awaiting further vendor guidance.