CVE-2026-89026

CVE-2026-89026 Issabel pbxapi ハードコードされた JWT RCE POC Issabel Framework pbxapi — 未認証の JWT 偽造（ハードコードされた HS256 キー）を行い、その後 GET /pbxapi/manager/originate を Application=System 付きで実行して、Asterisk ユーザーとして OS コマンドを実行します。コミット b97dbaf で修正済み（キーは /etc/issabel.conf から読み込まれます）。Shadowserver は 2026-09-09...

CVE-2026-89026

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

EUVD-2026-78838

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...