Issabel Framework Vulnerability: Critical JWT Signing Key Flaw
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- isabell framework (other)
- Patched version
- Not yet available
An early warning has been issued regarding a critical vulnerability in the Issabel Framework, which reportedly allows unauthenticated remote attackers to execute arbitrary operating system commands.
What happened
The Issabel Framework, a web-based framework for the open-source unified communications PBX software, is under investigation for containing a hard-coded HS256 JWT signing key. This key, which is identical across every installation, allows unauthenticated remote attackers to forge valid bearer tokens. Attackers can use these forged tokens to call specific endpoints, causing the Asterisk application to execute arbitrary OS commands as the Asterisk user.
The vulnerability, tracked as CVE-2026-89026, has a CVSS score of 9.8 and is reportedly being exploited in the wild. The Shadowserver Foundation first observed exploitation on September 9, 2026. However, details on the real-world abuse, the attackers, and the scale of the efforts remain unknown. Users of the Issabel Framework are advised to apply the latest fixes for optimal protection.
What to do about it
- Upgrade to a version of the Issabel Framework that fixes the hard-coded JWT signing key vulnerability.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- Apply the latest patches as soon as they are available to mitigate the risk of exploitation.
- Review your system for any signs of unauthorized access or command execution.
- Consider implementing additional security measures to protect against similar vulnerabilities.
How 0Day would have caught this
isabell framework is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Issabel Framework, you may be affected. Consult the primary sources for more detailed information on the vulnerability.
What should I do right now?
Upgrade to a version of the Issabel Framework that fixes the hard-coded JWT signing key vulnerability and monitor the primary sources for updates.
Has this been exploited in the wild?
Yes, the vulnerability is reportedly being exploited in the wild.