Full Report
A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded
Analysis Summary
# Vulnerability: Issabel Framework Hard-coded JWT Key RCE
## CVE Details
- **CVE ID:** CVE-2026-89026
- **CVSS Score:** 9.8 (Critical) via v3.1 / 9.3 (Critical) via v4.0
- **CWE:** CWE-798 (Use of Hard-coded Credentials) / CWE-77 (Command Injection)
## Affected Systems
- **Products:** Issabel Framework (Web-based framework for open-source unified communications PBX software).
- **Versions:** All versions prior to the patch committed on August 1, 2026.
- **Configurations:** Systems utilizing the `pbxapi` extension with default configurations.
## Vulnerability Description
The Issabel Framework contains a hard-coded HS256 JSON Web Token (JWT) signing key (`da893kasdfam43k29akdkfaFFlsdfhj23rasdf`) within the `pbxapi/index.php` file. Because this key is identical across all global installations, an unauthenticated remote attacker can forge valid Bearer tokens.
By presenting a forged token to the `/pbxapi/manager/originate` endpoint, an attacker can invoke the "System" application parameter. This allows the attacker to bypass authentication and instruct the underlying Asterisk engine to execute arbitrary operating system commands with the privileges of the `asterisk` user.
## Exploitation
- **Status:** **Exploited in the wild.** First observed by Shadowserver Foundation on September 9, 2026.
- **Complexity:** Low (requires only the knowledge of the hard-coded key to forge a token).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to PBX data and potential lateral movement).
- **Integrity:** High (Ability to modify system files and PBX configurations).
- **Availability:** High (Ability to disrupt communication services or shut down the server).
## Remediation
### Patches
- **Issabel Framework Update:** Apply the patch committed on August 1, 2026 ([GitHub Commit b97dbaf](https[:]//github[.]com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd)).
- This update replaces the static hard-coded string with a unique key stored locally in `/etc/issabel.conf`.
### Workarounds
- Restrict access to the `/pbxapi` endpoint via firewall or web server ACLs to trusted IP addresses only.
- Disable the `pbxapi` extension if it is not required for business operations.
## Detection
- **Indicators of Compromise:**
- Presence of the string `da893kasdfam43k29akdkfaFFlsdfhj23rasdf` in web logs or source code.
- Unusual `POST` requests to `/pbxapi/manager/originate` originating from unknown external IP addresses.
- Evidence of unexpected processes spawned by the `asterisk` user.
- **Detection Methods:** Audit the `pbxapi/index.php` file for the hard-coded signing key.
## References
- **Vendor Patch:** [https[:]//github[.]com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd]
- **VulnCheck Advisory:** [https[:]//www[.]vulncheck[.]com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate]
- **CVE Record:** [https[:]//www[.]cve[.]org/CVERecord?id=CVE-2026-89026]