EUVD-2026-45000Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because token recovery requires a separate database-read primitive; PR:N/UI:N as the storage flaw itself needs no auth; C:H/I:H reflect recovery of admin tokens granting PBX read and control; A:N as availability is not directly impacted.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.
AnalysisAI
Sensitive credential exposure in Frogman (an mwtcmi FreePBX module providing headless PBX control via MCP and an HTTP API) before 1.6.2 stores API tokens in cleartext, so any read of the oc_api_tokens database table yields fully reusable, active tokens at their assigned permission level - up to admin. Because Frogman.class.php authenticated the X-Frogman-Token header by directly comparing the presented value against the stored raw string, a leaked or read database directly hands an attacker working credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first obtain read access to the oc_api_tokens database table (e.g., via SQL injection in a co-hosted component, an exposed or unencrypted DB backup/dump, a shared or over-privileged database account, or insider/host access) - this is the concrete precondition reflected by CVSS AC:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credential-at-rest weakness rather than a directly remotely-triggerable flaw, and the CVSS vector reflects that tension: PR:N/AV:N raises the raw score, but AC:H (7.4) signals that exploitation depends on a precondition - the attacker must first obtain database read access (via SQL injection, a backup/dump leak, a shared or compromised DB account, or insider access). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who gains read access to the FreePBX database - for example through a SQL injection in another module, a leaked backup, or a shared hosting DB account - runs a simple SELECT against oc_api_tokens and reads the raw admin token directly. They then send it in the X-Frogman-Token header to the Frogman HTTP/MCP API and issue privileged PBX commands as an authenticated admin. … |
| Remediation | Vendor-released patch: 1.6.2 - upgrade Frogman to v1.6.2 (https://github.com/mwtcmi/frogman/releases/tag/v1.6.2), which stores tokens as salted-prefix SHA-256 digests ('sha256$<hash>') and ships an idempotent install.php migration that hashes any existing plaintext rows in oc_api_tokens (it also widens the token column to VARCHAR(80) to avoid truncating the 71-char hashed value). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Frogman, document current versions, and assess who has read access to the database and specifically to the oc_api_tokens table. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-256 – Plaintext Storage of a Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today