CVE-2026-89026

Critical9.8Published on September 15, 2026

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.

Early warning: exploitation observed

Exploitation observed since Sep 15, 2026
Not yet in the official CISA catalogue
Attacked 1 day before the vulnerability was made public

Source: VulnCheck KEV · Sep 15, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-321

Vulnerabilities

One Shared JWT Secret Exposes Issabel PBX Servers to Remote Command Execution

CVE-2026-89026 in Issabel Framework lets unauthenticated attackers forge JWTs with a hard-coded key and execute commands as Asterisk via pbxapi.

Sep 17, 202605:205 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

One Shared JWT Secret Exposes Issabel PBX Servers to Remote Command Execution