The Issabel Framework includes a hard‑coded HS256 JWT signing key that is identical across all installations prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. Attackers can generate a valid bearer token without any authentication and then call the manager originate endpoint with the System application parameter. Asterisk subsequently executes the supplied command string as the Asterisk user, granting the attacker arbitrary OS command execution on the host. Shadowserver observed active exploitation on 2026-09-09, confirming real‑world usage.

The vulnerability affects all deployments of Issabel Foundation’s Issabel Framework that use the pbxapi index.php file prior to the fix incorporated in commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. Any installation that has not applied this patch is vulnerable.

The CVSS score of 9.3 reflects a high severity, and the EPSS score of 3% indicates a nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely forge a bearer token without authentication and evolve it over HTTP or HTTPS to the pbxapi/manager/originate endpoint, causing Asterisk to run arbitrary OS commands as the Asterisk user. Because the flaw bypasses authentication, remote exploitation is straightforward.