A hard-coded HS256 JWT signing key in the Issabel Framework lets unauthenticated remote attackers forge bearer tokens and drive Asterisk into executing arbitrary OS commands.
What Is It
The Issabel Framework, the web framework behind Issabel PBX software, ships a hard-coded HS256 JWT signing key inside the pbxapi index.php file. Because that key is identical across every installation, any attacker who knows it can mint valid bearer tokens without credentials.
Authentication is only the first step. With a forged token, an attacker calls the manager originate endpoint and supplies the System application parameter, which causes Asterisk to execute arbitrary operating system commands as the Asterisk user. The issue is classified as CWE-321 (Use of Hard-coded Cryptographic Key).
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). It is network-reachable, low-complexity, and requires neither privileges nor user interaction, and it fully compromises confidentiality, integrity, and availability.
The severity here does not depend on exploitation activity: a shared static signing key means a single publicly known secret unlocks every unpatched deployment, so there is no per-install barrier for attackers to overcome. Separately, the source material passed to us attributes an exploitation observation to the Shadowserver Foundation with a first-seen date of 2026-09-09, several days ahead of publication. No Shadowserver advisory, dashboard, or telemetry record accompanied that attribution, and we were unable to corroborate it against a primary source; treat it as an unconfirmed report rather than established in-the-wild exploitation, and verify directly with Shadowserver before using it to justify emergency action.
What's Vulnerable
- Vendor: Issabel Foundation
- Product: Issabel Framework (the web framework supporting Issabel PBX)
- Affected versions: all builds from the repository prior to commit
b97dbaf0b71c1c36f841e672b664afbeb02773bd - Repository:
https://github.com/IssabelFoundation/framework
The vulnerable component is the pbxapi index.php file and the manager originate endpoint it exposes.
Patch Status
The issue is fixed upstream in commit b97dbaf0b71c1c36f841e672b664afbeb02773bd in the IssabelFoundation/framework repository. Installations tracking any earlier commit are affected and should be updated to that commit or later.
No CISA KEV entry was supplied for this CVE, so there is no federal Known Exploited Vulnerabilities listing or associated required-action due date in the source material. NVD records the CVE as published 2026-09-15 with vulnStatus of "Received," meaning NVD analysis was still pending; enrichment such as CPE match data and NVD-assigned scoring may not yet be available to downstream scanners keying off that feed.
Sources
- NVD, CVE-2026-89026: https://nvd.nist.gov/vuln/detail/CVE-2026-89026
- VulnCheck Advisory; Issabel PBX Hard-Coded JWT Key RCE via pbxapi Manager Originate: https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate
- IssabelFoundation/framework; fix commit b97dbaf: https://github.com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd