One Key for Every PBX: The Issabel Framework Hardcoded JWT Flaw (CVE-2026-89026)
One Key for Every PBX: The Issabel Framework Hardcoded JWT Flaw (CVE-2026-89026) Issabel Framework, an open-source unified communications platform built around Asterisk, shipped with a single HS256 signing key hardcoded in its pbxapi component. Because every deployment used the same value, an attacker who learned it could mint a valid bearer token for any installation. The vulnerability is…
The Issabel Framework, an open-source unified communications platform built on Asterisk, suffered a significant security flaw due to a hardcoded JSON Web Token (JWT) signing key. This vulnerability, identified as CVE-2026-89026, allowed an attacker to generate valid bearer tokens for any installation, as all deployments shared the same secret.
The flaw was fixed in commit b97dbaf, and public proof-of-concept code was available. The pbxapi layer, responsible for validating JWTs, could be manipulated by an attacker to execute arbitrary commands with the Asterisk process's privileges. This posed a significant risk beyond the phone system, as PBXs often serve as network gateways, enabling the attacker to modify call routing, access call detail records, harvest extension credentials, and even use the host as a foothold for lateral movement.
The flaw required no user interaction and could be exploited remotely via the pbxapi endpoint. Remediation involved applying the upstream fix to remove the hardcoded key and rotating the signing secret on every instance. Network restriction of pbxapi access could serve as a temporary mitigation if an immediate upgrade was not feasible.
The full impact of the vulnerability was not quantified, as public advisories did not provide specific data on the number of affected installations.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
