CVE-2026-89026 in Issabel
Summary
by MITRE • 09/15/2026
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The Issabel Framework, which serves as the foundational web layer for the Issabel PBX software suite, suffered from a critical authentication bypass vulnerability prior to commit b97dbaf. This flaw stemmed directly from poor cryptographic key management practices embedded within the application codebase. Specifically, the pbxapi index.php file contained a hard-coded HS256 JSON Web Token signing key that was identical across all installations of the software. In secure system design, secret keys used for digital signatures must be unique per deployment and generated using cryptographically secure random number generators to prevent prediction or replication by adversaries. By utilizing a static, universally shared secret, the framework failed to establish any meaningful trust boundary between different instances of the PBX system. This architectural oversight meant that knowledge of this single key allowed an attacker to bypass authentication mechanisms entirely, as they could generate valid tokens indistinguishable from those issued by legitimate administrative sessions.
The operational impact of this vulnerability is severe due to its direct link to remote code execution capabilities within the underlying Asterisk telephony engine. Once an unauthenticated remote attacker obtains a forged bearer token using the hard-coded key, they can interact with the pbxapi interface without restriction. The most dangerous vector involves calling the manager originate endpoint while specifying the System application parameter. In this context, the System application acts as a bridge to execute shell commands on the host operating system where Asterisk is running. Consequently, an attacker who successfully forges and presents a valid JWT can inject arbitrary OS-level commands that are executed with the privileges of the user account under which the Asterisk service operates. This effectively grants full control over the server hosting the PBX software, allowing for data exfiltration, lateral movement within the network, or complete system compromise.
This vulnerability aligns closely with CWE-798: Use of Hard-coded Credentials and CWE-209: Generation of Error Message Containing Sensitive Information in terms of its root cause, although the primary failure is the static nature of the cryptographic key rather than an error message leak. From a threat modeling perspective, this attack path corresponds to ATT&CK technique T1136.001: Create Account: Local Account if new accounts are created via command injection, or more accurately T1528: Steal Application Access Token when focusing on the JWT forgery aspect, followed by T1059: Command and Scripting Interpreter for the subsequent OS execution. The severity is further amplified by the fact that exploitation evidence was observed in the wild by the Shadowserver Foundation on 2026-09-09, indicating active targeting of vulnerable instances before patches were widely deployed or recognized as critical threats.
Mitigation requires immediate remediation through software updates to versions containing commit b97dbaf or later, which presumably replaces the hard-coded key with a dynamically generated one per installation. Organizations running affected versions should also implement network-level controls such as firewall rules restricting access to the pbxapi endpoints from untrusted networks and monitoring for anomalous traffic patterns indicative of JWT forgery attempts. Additionally, auditing system logs for unexpected process executions by the Asterisk user can help detect ongoing exploitation activities. Long-term security hygiene demands that all cryptographic secrets be managed via secure key management systems rather than being embedded in source code, ensuring uniqueness and confidentiality across deployments.