SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-46513

HIGH · CVSS 7.4 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-16 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

Frogman versions prior to 1.6.2 are vulnerable due to improper storage of API tokens, which are stored as raw strings, allowing attackers to recover active tokens and gain unauthorized database access at the associated permission level, including administrative rights. Organizations using Frogman for PBX control should prioritize upgrading to version 1.6.2 to mitigate the risk of token exploitation and potential data breaches. This vulnerability poses a significant threat to systems relying on the API for secure communications.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-46513
Severity
HIGH
CVSS
7.4
EPSS
0.26%

Original NVD Description

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.