A hard-coded HS256 signing key in the Issabel Framework allows unauthenticated attackers to forge JWTs and execute arbitrary commands via the Asterisk manager originate endpoint.
PoC
Issabel Framework +2
remote-code-execution
pbx
cve-2026-89026
2t
1c
updated