Read the docs
TI-2026-60335 Aliases CVE-2026-89026GHSA-mmrg-2gjg-78x9

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

Priority MEDIUM 53CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02699 86th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89026
  2. 2026-10-03 Alias added: GHSA-mmrg-2gjg-78x9

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences