issabelfoundation/framework vulnerabilities

Latest issabelfoundation/framework CVEs

Newest publication first

1. CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

   Published 2026-09-15

   Critical·CVSS 9.3 EPSS 2.7%

   The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.