Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-89026

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

CVSS 4.0 9.3 CRITICALCVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-89026

Published

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89026

Published

Issabel Framework

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "Issabel Foundation",
                    "product": "Issabel Framework",
                    "packageURL": "pkg:github/IssabelFoundation/framework",
                    "repo": "https://github.com/IssabelFoundation/framework",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "git",
                            "lessThan": "b97dbaf0b71c1c36f841e672b664afbeb02773bd"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON