Is CVE-2026-46513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46513 being exploited in the wild.

How severe is CVE-2026-46513?

High severity, with a CVSS score of 7.4, published 16 July 2026.

Is there a fix for CVE-2026-46513?

A patch was published on 2026-05-13: Initial security release v1.6.1 published; later superseded by v1.6.2 due to installation script errors. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46513 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46513?

Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46513: mwtcmi Frogman plaintext storage of API tokens

CVE-2026-46513 · Severity: high · CVSS 7.4 · Published 2026-07-16

Frogman, a tool used for controlling PBX phone systems, was found to store API access tokens in plain text within its database. If an attacker gains access to the database—through a backup leak or a separate security flaw—they can steal these tokens to gain full administrative control over the phone system. This could lead to unauthorized call routing, data theft, or complete system takeover.

Technologies: Mwtcmi Frogman. Vendors: Mwtcmi.

Quick answers

Is CVE-2026-46513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46513 being exploited in the wild.
How severe is CVE-2026-46513?: High severity, with a CVSS score of 7.4, published 16 July 2026.
Which products and versions are affected?: Mwtcmi Frogman < 1.6.2.
Is there a fix for CVE-2026-46513?: A patch was published on 2026-05-13: Initial security release v1.6.1 published; later superseded by v1.6.2 due to installation script errors. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46513 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46513?: Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Frogman prior to version 1.6.2 stores API tokens generated by 'Tools/CreateApiToken.php' as raw hex-encoded random strings in the 'oc_api_tokens' table. The authentication logic in 'Frogman.class.php' performs a direct comparison between the 'X-Frogman-Token' HTTP header and the stored plaintext value. This lack of one-way hashing means that any secondary vulnerability (such as SQL injection in another module) or misconfiguration (such as exposed backups) that grants database read access allows an attacker to recover reusable credentials. The vulnerability is addressed in version 1.6.2 by migrating to SHA-256 hashed storage.

Affected products

mwtcmi frogman < 1.6.2

Timeline

2026-05-13: patched: Initial security release v1.6.1 published; later superseded by v1.6.2 due to installation script errors.
2026-07-16: disclosed: CVE-2026-46513 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.