Executive brief
Frogman, a tool used for controlling PBX phone systems, was found to store API access tokens in plain text within its database. If an attacker gains access to the database—through a backup leak or a separate security flaw—they can steal these tokens to gain full administrative control over the phone system. This could lead to unauthorized call routing, data theft, or complete system takeover.
Technical details
Frogman prior to version 1.6.2 stores API tokens generated by 'Tools/CreateApiToken.php' as raw hex-encoded random strings in the 'oc_api_tokens' table. The authentication logic in 'Frogman.class.php' performs a direct comparison between the 'X-Frogman-Token' HTTP header and the stored plaintext value. This lack of one-way hashing means that any secondary vulnerability (such as SQL injection in another module) or misconfiguration (such as exposed backups) that grants database read access allows an attacker to recover reusable credentials. The vulnerability is addressed in version 1.6.2 by migrating to SHA-256 hashed storage.
Affected products
- mwtcmi frogman < 1.6.2
Timeline
- 2026-05-13: patched: Initial security release v1.6.1 published; later superseded by v1.6.2 due to installation script errors.
- 2026-07-16: disclosed: CVE-2026-46513 published.