11 matches found
CVE-2026-89026
CVE-2026-89026 Issabel pbxapi JWT hardcodeado RCE POC Issabel Framework pbxapi — falsificación de JWT no autenticada clave HS256 hardcodeada y luego GET /pbxapi/manager/originate con Application=System para ejecutar comandos del sistema operativo como el usuario de Asterisk. Parcheado en el commi...
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3, which can allow an unauthenticated remote...
CVE-2026-89026
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
EUVD-2026-78838
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
CVE-2026-89026
Issabel Framework (web framework for Issabel PBX) contained a hard-coded HS256 JWT signing key in pbxapi/index.php, identical across all installations. Unauthenticated attackers could forge valid bearer tokens and call /pbxapi/manager/originate with the System application parameter, causing Aster...
VulnCheck KEV: CVE-2026-89026
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
PT-2026-92132
Name of the Vulnerable Software and Affected Versions Issabel Framework versions prior to commit b97dbaf Description The Issabel Framework contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across all installations. This allows unauthenticated remote...
CVE-2026-89026: Use of Hard-coded Cryptographic Key
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...