Which versions of Frogman are affected by EUVD-2026-45002?

Frogman versions before 1.6.3 contain a critical authorization bypass allowing any authenticated user to access sensitive credentials including SIP passwords, SSH keys, and OAuth secrets.. A patch is available.

How to fix or mitigate EUVD-2026-45002?

Within 24 hours, audit Frogman deployment locations and access logs for exploitation attempts; within 7 days, upgrade all instances to Frogman 1.6.3 or later; within 30 days, rotate all AMI manager credentials, SIP passwords, SSH keys, and OAuth secrets, and conduct forensic analysis of administrative tool invocations during the vulnerability window.

Frogman EUVD-2026-45002

Q: What is the CVSS score of EUVD-2026-45002?

EUVD-2026-45002 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-46515 CRITICAL

Missing Authorization (CWE-862)

2026-07-16 GitHub_M

Authentication Bypass Frogman Mwtcmi

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-reachable API needing only a low-privilege read token (PR:L, AC:L); leaked host/trunk secrets and arbitrary saved-query execution cross into the Asterisk backend (S:C, C:H/I:H), with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 18:49 vuln.today

Analysis Generated

Jul 16, 2026 - 18:49 vuln.today

CVE Published

Jul 16, 2026 - 18:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5_cred, and oauth_secret. This issue is fixed in version 1.6.3.

AnalysisAI

Missing authorization in Frogman, a headless Asterisk PBX control layer exposed over MCP and an HTTP API, lets any low-privilege PERM_READ caller invoke eight administrative tools (fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, fm_diagnose_trunk) that should require admin, leaking AMI manager secrets, outbound dial PINs, full dialplan context, root SSH connection commands, backup artifact paths, CDR history, and raw AMI endpoint dumps containing SIP password/md5_cred/oauth_secret fields, plus executing arbitrary saved GraphQL queries. All releases prior to 1.6.3 are affected, tracked under GHSA-q4c4-5cr4-8q47 with a CVSS 4.0 score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Frogman is a control plane for Asterisk PBX systems that exposes operational tooling through the Model Context Protocol (MCP) and an HTTP API so automation or AI agents can query and manage telephony state. Each tool declares a permission level, and the root cause is CWE-862 (Missing Authorization): read-tier tools were assigned PERM_READ despite surfacing secret material. The source evidence (commit 55ea257 on Tools/DiagnoseTrunk.php) shows fm_diagnose_trunk being raised to PERM_ADMIN and adding line-level redaction of Asterisk pjsip endpoint/registration dumps, because those free-text key/value dumps embed SIP credential fields (password, auth_password, md5_cred, oauth_secret, refresh_token, dtls_private_key). A prior audit-log fix (GHSA-3p65-2prr-cfvf) only redacted known-sensitive keys, so values under generic field names still leaked into both the response payload and the audit log. The affected package is identified by CPE cpe:2.3:a:mwtcmi:frogman.

RemediationAI

Vendor-released patch: upgrade to Frogman 1.6.3, which reassigns the affected tools (notably fm_diagnose_trunk) to PERM_ADMIN and adds line-level redaction of SIP credential fields in pjsip endpoint/registration dumps before they reach responses or the audit log; follow GHSA-q4c4-5cr4-8q47 (https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47). If you cannot upgrade immediately, restrict who holds PERM_READ tokens and treat them as privileged, and at the network layer limit access to the MCP and HTTP API endpoints to trusted admin operators only - accepting that this breaks any legitimate read-only automation that relied on those tools. Because the leaked material includes AMI manager secrets, outbound PINs, and root SSH commands, also rotate AMI manager credentials, SIP passwords/md5_cred/oauth_secret values, dial PINs, and any exposed SSH keys, since patching alone does not invalidate already-disclosed secrets. Review pre-fix Frogman audit-log rows, as they may contain unredacted credential values.