CVE-2026-46514
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in Frogman before version 1.6.2 causes plaintext password and secret leakage. The fm_reset_password and fm_add_extension functions return credentials that are then stored in the audit log (oc_audit_log.detail) as JSON. Any user with PERM_READ permission and access to fm_audit_search can recover the stored credentials.
Risk Assessment
The organization is at risk of PBX extension password and secret theft, which could lead to unauthorized access to the phone system, call eavesdropping, or further attacks on the infrastructure.
Recommendation
Immediately upgrade Frogman to version 1.6.2 or later. After upgrading, remove old audit log entries containing plaintext passwords and secrets.
Other vulnerabilities in Frogman
See all- CVE-2026-46515Critical
In Frogman prior to version 1.6.3, users with PERM_READ access could call sensitive API functions, exposing AMI secrets, outbound dial PINs, Asterisk dialplan contexts, SSH commands, backup paths, CDR history, and raw AMI dumps with SIP fields (passwords, md5_cred, oauth_secret).
- CVE-2026-46512Critical
In Frogman prior to version 1.6.2, the fm_dialplan_apply function accepted template parameters (greeting, dest, url, extension, code, file) without proper sanitization, allowing a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.
- CVE-2026-46516Medium
Frogman prior to 1.6.6 has a vulnerability in its chat Markdown formatter – it inserts raw regex capture groups as HTML. User-controlled fields (e.g., extension names, IVR descriptions) can carry JavaScript payloads that execute when an admin views the response.
- CVE-2026-46513High
Frogman prior to version 1.6.2 stored API tokens as raw hex strings and authenticated the X-Frogman-Token header by comparing it with the stored raw value. This allowed reading active tokens, including admin tokens, from the database and reusing them.
Original NVD description (English source)
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.