Description
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Issabel Foundation | Issabel Framework | — | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
AranFarzami/CVE-2026-89026 ★ 1 · Sep 21, 2026
PoC exploit and scanner for CVE-2026-89026, targeting the Issabel PBXAPI authentication vulnerability
-
im-hanzou/CVE-2026-89026 ★ 0 · Sep 17, 2026
Issabel pbxapi hard coded JWT RCE POC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Issabel Framework - Hard-Coded PBX API JWT Key http/cves/2026/CVE-2026-89026.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- Patch Commit patch
- https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate third-party-advisory