EUVD-2026-45000Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because token recovery requires a separate database-read primitive; PR:N/UI:N as the storage flaw itself needs no auth; C:H/I:H reflect recovery of admin tokens granting PBX read and control; A:N as availability is not directly impacted.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.
AnalysisAI
Sensitive credential exposure in Frogman (an mwtcmi FreePBX module providing headless PBX control via MCP and an HTTP API) before 1.6.2 stores API tokens in cleartext, so any read of the oc_api_tokens database table yields fully reusable, active tokens at their assigned permission level - up to admin. Because Frogman.class.php authenticated the X-Frogman-Token header by directly comparing the presented value against the stored raw string, a leaked or read database directly hands an attacker working credentials. Rated CVSS 7.4 (high); no public exploit identified at time of analysis, and the issue is fixed in version 1.6.2.
Technical ContextAI
Frogman is a PHP-based FreePBX/asterisk companion module (CPE cpe:2.3:a:mwtcmi:frogman) exposing PBX control through the Model Context Protocol and an HTTP API guarded by a bearer-style X-Frogman-Token header. Tokens were minted in Tools/CreateApiToken.php as bin2hex(random_bytes(32)) - cryptographically strong 64-hex-char secrets - but were persisted verbatim into the oc_api_tokens.token column and authenticated by a raw equality comparison in Frogman.class.php:78. This is a textbook CWE-256 (Plaintext Storage of Sensitive Information / unprotected credential storage): the secret's strength is irrelevant once it sits in the datastore in recoverable form, since any DB-read primitive recovers a credential that is valid as-presented. The fix reworks the schema (module.xml token column widened from VARCHAR(64) to 80) and stores a self-describing 'sha256$<hash>' digest, returning the raw token to the caller only once at creation; install.php runs an idempotent migration hashing any pre-existing plaintext rows, and the List/Delete/Revoke tools were updated to never echo token previews.
RemediationAI
Vendor-released patch: 1.6.2 - upgrade Frogman to v1.6.2 (https://github.com/mwtcmi/frogman/releases/tag/v1.6.2), which stores tokens as salted-prefix SHA-256 digests ('sha256$<hash>') and ships an idempotent install.php migration that hashes any existing plaintext rows in oc_api_tokens (it also widens the token column to VARCHAR(80) to avoid truncating the 71-char hashed value). Because pre-1.6.2 tokens were stored and possibly leaked in cleartext, treat all previously issued tokens as compromised: after upgrading, revoke and reissue every API token (the migration hashes existing values but cannot undo prior exposure), and rotate any admin-level tokens first. If immediate upgrade is not possible, restrict database read access to the oc_api_tokens table to only the FreePBX/Frogman service account, ensure DB backups and dumps containing this table are encrypted and access-controlled, and place the Frogman HTTP/MCP endpoint behind network segmentation or an allowlist so a recovered token cannot be replayed from arbitrary networks - the trade-off being that legitimate remote API/MCP consumers must be added to the allowlist. Reference GHSA-9xf5-9ghq-p6cw and commit b10f314 for the exact changes.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-256 – Plaintext Storage of a Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today