Issabel Framework - Hard-Coded PBX API JWT Key

Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after...

CVE-2026-89026

CVE-2026-89026 Issabel pbxapi JWT hardcodeado RCE POC Issabel Framework pbxapi — falsificación de JWT no autenticada clave HS256 hardcodeada y luego GET /pbxapi/manager/originate con Application=System para ejecutar comandos del sistema operativo como el usuario de Asterisk. Parcheado en el commi...

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3, which can allow an unauthenticated remote...

CVE-2026-89026

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

EUVD-2026-78838

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026

Issabel Framework (web framework for Issabel PBX) contained a hard-coded HS256 JWT signing key in pbxapi/index.php, identical across all installations. Unauthenticated attackers could forge valid bearer tokens and call /pbxapi/manager/originate with the System application parameter, causing Aster...

CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026: Use of Hard-coded Cryptographic Key

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

PT-2026-92132

Name of the Vulnerable Software and Affected Versions Issabel Framework versions prior to commit b97dbaf Description The Issabel Framework contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across all installations. This allows unauthenticated remote...

VulnCheck KEV: CVE-2026-89026

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...