Frogman stored API tokens directly in the database, using raw hex strings generated by random_bytes. The authentication routine compared the X‑Frogman‑Token header with this stored value, allowing an attacker who can read the oc_api_tokens table to recover active tokens that may have admin or elevated permissions. This flaw results in a violation of confidentiality and privilege escalation (CWE‑256).

The vulnerability affects the Frogman PBX control software developed by mwtcmi, specifically versions prior to 1.6.2. The fix was released in v1.6.2, with v1.6.1 still vulnerable.

Based on the description, it is inferred that the most likely attack vector is through database read access, as the flaw requires an attacker to read the oc_api_tokens table to retrieve stored plain‑text tokens – a privilege available only to users with database credentials or to those who can compromise the system. Once a token is obtained, the attacker can replay it via the X‑Frogman‑Token header to gain the permissions originally granted to that token, including administrative rights. The CVSS score of 7.4 indicates a high severity, the EPSS score is less than 1% suggesting current exploitation probability is very low, and the vulnerability is not listed in the CISA KEV catalog.