Executive brief
Issabel Framework, a web platform that powers Issabel PBX phone systems, contains a hard-coded cryptographic key used to sign authentication tokens. An attacker can use this key to forge valid authentication tokens without logging in, then abuse the system to execute arbitrary commands on the underlying server. This allows complete compromise of the phone system and its host.
Technical details
The Issabel Framework contains a hard-coded HS256 JWT signing key embedded in the pbxapi/index.php file that is identical across all installations (CWE-321: Use of Hard-coded Cryptographic Key). An unauthenticated attacker with network access can forge valid JWT bearer tokens using this key. By calling the pbxapi manager/originate endpoint with a forged token and specifying the System application parameter, the attacker can cause the underlying Asterisk telephony engine to execute arbitrary OS commands with the privileges of the Asterisk process. The vulnerability requires no authentication and no user interaction. The fix is available in commit b97dbaf, which moves JWT key storage to an external configuration file.
Affected products
- Issabel Foundation Framework before commit b97dbaf
- Issabel Foundation Issabel PBX versions using Framework before commit b97dbaf
Timeline
- 2026-09-09: exploited: Exploitation evidence first observed by Shadowserver Foundation
- 2026-09-15: advisory: Public advisory published
- 2026-09-15: patched: Fix available in commit b97dbaf