Hard-Coded JWT Key in Issabel Framework Enabling RCE

The Issabel Framework, which serves as the web management interface for Issabel PBX software, contains a critical security vulnerability (CVE-2026-89026) due to a hard-coded HS256 JWT signing key present in the 'pbxapi/index.php' file. This key is identical across all Issabel PBX installations, enabling unauthenticated remote attackers to generate valid bearer tokens. By utilizing these forged tokens, an attacker can authenticate to the 'manager originate' endpoint. This endpoint, intended for administrative control of the telephony system, accepts an 'Application' parameter that supports the 'System' command. Attackers can leverage this to execute arbitrary OS commands on the host system running with the privileges of the Asterisk user. The Shadowserver Foundation first observed exploitation of this vulnerability in the wild on September 9, 2026. This issue affects versions of the Issabel Framework prior to commit b97dbaf.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Issabel PBX instances.
2. Attacker retrieves the hard-coded HS256 signing key from publicly available repository commits.
3. Attacker crafts a malicious JWT using the compromised secret and signs it to impersonate a privileged administrator.
4. Attacker sends an HTTP request to the '/pbxapi/index.php' endpoint or related API routes with the forged Bearer token in the Authorization header.
5. Attacker makes a request to the 'manager originate' API endpoint, injecting the 'System' application string with a malicious OS command into the request body.
6. The Asterisk service receives the command and interprets the 'System' parameter, spawning a shell process.
7. Arbitrary code executes on the underlying operating system with the permissions of the Asterisk user.

Impact

Successful exploitation grants unauthenticated attackers full remote code execution on Issabel PBX appliances. This allows for total system compromise, including the ability to exfiltrate call records, intercept communications, or pivot into the internal network. Exploitation has been observed in the wild by the Shadowserver Foundation, indicating wide-scale scanning and targeting of vulnerable PBX infrastructure.

Recommendation

• Immediately update Issabel Framework to commit b97dbaf or later to remove the hard-coded secret and implement unique per-installation key management.
• Restrict access to the Issabel PBX management web interface and API endpoints (pbxapi) to trusted management subnets using firewall rules.
• Monitor web server access logs for anomalous POST requests to 'pbxapi/index.php' followed by 'manager originate' parameters.
• Review all scheduled jobs and user accounts on Issabel PBX servers for signs of persistence established by the Asterisk user.