CVE-2026-57196

A flaw was found in Asterisk. When phone provisioning resphoneprov is enabled, reflected cross-site scripting in HTTP error pages allows an unauthenticated remote attacker to steal an authorized user's Asterisk Manager Interface AMI session cookie and impersonate that user. Exploitation requires...