## What Happened
A critical flaw in Issabel Framework (web-based unified communications PBX framework) is being actively exploited. The issue, CVE-2026-89026 (CVSS v3.1: 9.8; CVSS v4.0: 9.3), enables unauthenticated remote attackers to execute arbitrary OS commands.
## Technical Details
- The vulnerability stems from a hard-coded HS256 JSON Web Token (JWT) signing key in pbxapi/index.php that is identical across installations.
- Because the key is shared, attackers can forge valid bearer tokens without authentication.
- With a forged token, attackers can call the manager endpoint '/pbxapi/manager/originate' using the System application parameter.
- This can cause Asterisk to execute arbitrary OS commands as the Asterisk user.
## Affected
- Issabel Framework installations using the vulnerable pbxapi/index.php JWT signing key.
## Impact
- Unauthenticated remote OS command execution via forged JWT bearer tokens and the /pbxapi/manager/originate endpoint.
## Mitigation
1. Apply the vendor patch. A fix was pushed on August 1, 2026.
2. The patch replaces the hard-coded JWT key in pbxapi/index.php with a JWT key stored in /etc/issabel.conf.
3. After patching, verify the JWT signing key source is no longer hard-coded in pbxapi/index.php and that /etc/issabel.conf is correctly configured.
Ravie LakshmananSep 16, 2026Vulnerability / Web Security
A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.
The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded JSON Web Token (JWT) signing key.
The Issabel Framework "contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens," VulnCheck said in an alert.
"Attackers can use the forged token to call the manager '/pbxapi/manager/originate' endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user."
A patch for the vulnerability was pushed on August 1, 2026, and plugs the flaw by replacing the hard-coded JWT key ("da893kasdfam43k29akdkfaFFlsdfhj23rasdf") with a JWT key stored in the "/etc/issabel.conf" file.
According to the cybersecurity company, the Shadowserver Foundation first observed exploitation of CVE-2026-89026 on September 9, 2026. That said, there are currently no details on how the vulnerability is being abused in real-world attacks, who is behind them, and the scale of such efforts.
Users of the Issabel Framework are advised to apply the latest fixes for optimal protection.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.