CVE-2026-89026
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.
Early warning: exploitation observed
- Exploitation observed since Sep 15, 2026
- Not yet in the official CISA catalogue
- Attacked 1 day before the vulnerability was made public
- Confirmed by sensors, not only by reports
Source: VulnCheck KEV · Nov 6, 2026 Nov 5, 2026 Nov 4, 2026 Nov 3, 2026 Nov 3, 2026 Nov 2, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRelated articles
Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels
Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.
One Shared JWT Secret Exposes Issabel PBX Servers to Remote Command Execution
CVE-2026-89026 in Issabel Framework lets unauthenticated attackers forge JWTs with a hard-coded key and execute commands as Asterisk via pbxapi.
This product uses the NVD API but is not endorsed or certified by the NVD.