Issabel Framework hard-coded JWT → unauth OS command exec (CVE-2026-89026); CVSS 9.8/9.3; exploited
VulnCheck advisory (15 September 2026) covers CVE-2026-89026 in Issabel Framework (web UI for Issabel PBX / Asterisk). Before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd the pbxapi index.php embeds a hard-coded HS256 JWT signing key identical on every install (CWE-321). Unauthenticated attackers forge bearer tokens and call /pbxapi/manager/originate with the System application parameter so Asterisk runs arbitrary OS commands as the Asterisk user. VulnCheck rates CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N); The Hacker News cites CVSS 3.1 9.8. Patch (1 August 2026) replaces the hard-coded key with a key from /etc/issabel.conf. Shadowserver first observed exploitation on 9 September 2026; scale/actors not detailed. Apply the patched framework commit or later; rotate any JWT material that relied on the shared key. Primary: VulnCheck advisory; wire: The Hacker News 16 Sep 2026.
- Product
- Issabel Framework (Issabel PBX / Asterisk pbxapi)
- Versions
- Framework before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd (hard-coded JWT in pbxapi index.php)
- CVSS
- (CVSS 3.1 per THN); 9.3 (CVSS 4.0, VulnCheck)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Exploited in Australia?
- unknown
- Patch to
- Issabel Framework at/after commit b97dbaf0b71c1c36f841e672b664afbeb02773bd; ensure JWT key is unique per host via /etc/issabel.conf
Primary: VulnCheck — Issabel Framework hard-coded JWT RCE (CVE-2026-89026) · Vendor: IssabelFoundation/framework — patch commit b97dbaf (1 Aug 2026) · CVE: CVE-2026-89026 · The Hacker News — Issabel Framework exploitation (16 Sep 2026)