# CVE-2026-46513: mwtcmi Frogman plaintext storage of API tokens

Source: https://junglewise.ai/threats/cve-2026-46513-mwtcmi-frogman-plaintext-storage-of-api-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-46513 · Severity: high · CVSS 7.4 · Published 2026-07-16

Frogman, a tool used for controlling PBX phone systems, was found to store API access tokens in plain text within its database. If an attacker gains access to the database—through a backup leak or a separate security flaw—they can steal these tokens to gain full administrative control over the phone system. This could lead to unauthorized call routing, data theft, or complete system takeover.

Technologies: [Mwtcmi Frogman](https://junglewise.ai/threats/technologies/frogman). Vendors: [Mwtcmi](https://junglewise.ai/threats/vendors/mwtcmi).

## Quick answers

**Is CVE-2026-46513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46513 being exploited in the wild.

**How severe is CVE-2026-46513?** High severity, with a CVSS score of 7.4, published 16 July 2026.

**Which products and versions are affected?** Mwtcmi Frogman < 1.6.2.

**Is there a fix for CVE-2026-46513?** A patch was published on 2026-05-13: Initial security release v1.6.1 published; later superseded by v1.6.2 due to installation script errors. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46513 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46513?** Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Frogman prior to version 1.6.2 stores API tokens generated by 'Tools/CreateApiToken.php' as raw hex-encoded random strings in the 'oc_api_tokens' table. The authentication logic in 'Frogman.class.php' performs a direct comparison between the 'X-Frogman-Token' HTTP header and the stored plaintext value. This lack of one-way hashing means that any secondary vulnerability (such as SQL injection in another module) or misconfiguration (such as exposed backups) that grants database read access allows an attacker to recover reusable credentials. The vulnerability is addressed in version 1.6.2 by migrating to SHA-256 hashed storage.

## Affected products

- mwtcmi frogman < 1.6.2

## Timeline

- 2026-05-13: patched: Initial security release v1.6.1 published; later superseded by v1.6.2 due to installation script errors.
- 2026-07-16: disclosed: CVE-2026-46513 published.

## References

- [https://github.com/mwtcmi/frogman/commit/b10f314add08c8e7585ba4b27d071b07d026ab55](https://github.com/mwtcmi/frogman/commit/b10f314add08c8e7585ba4b27d071b07d026ab55)
- [https://github.com/mwtcmi/frogman/releases/tag/v1.6.1](https://github.com/mwtcmi/frogman/releases/tag/v1.6.1)
- [https://github.com/mwtcmi/frogman/releases/tag/v1.6.2](https://github.com/mwtcmi/frogman/releases/tag/v1.6.2)
- [https://github.com/mwtcmi/frogman/security/advisories/GHSA-9xf5-9ghq-p6cw](https://github.com/mwtcmi/frogman/security/advisories/GHSA-9xf5-9ghq-p6cw)

## Related threats

- [mwtcmi Frogman stored XSS in chat console formatter](https://junglewise.ai/threats/cve-2026-46516-mwtcmi-frogman-stored-xss-in-chat-console-formatter)
- [mwtcmi Frogman missing authorization in multiple API tools](https://junglewise.ai/threats/cve-2026-46515-mwtcmi-frogman-missing-authorization-in-multiple-api-tools)
- [mwtcmi Frogman plaintext credential disclosure in audit logs](https://junglewise.ai/threats/cve-2026-46514-mwtcmi-frogman-plaintext-credential-disclosure-in-audit-logs)
- [mwtcmi Frogman code injection in fm_dialplan_apply](https://junglewise.ai/threats/cve-2026-46512-mwtcmi-frogman-code-injection-in-fm-dialplan-apply)