Issabel PBX Hard-Coded JWT Signing Key Remote Code Execution

Technical Analysis

The vulnerability stems from a static, publicly-known HS256 secret embedded in pbxapi's index.php prior to commit b97dbaf, which is used to sign and validate JWT bearer tokens for the PBX API. Because the key is identical on every deployment, an attacker with no credentials can craft a valid signed token and authenticate as a privileged API user. With a forged token, the attacker can call the Asterisk manager originate endpoint and pass the System application parameter, which Asterisk executes as an OS-level shell command under the asterisk service account, yielding remote code execution with CVSS 9.8. This is a classic cryptographic key-management failure (hard-coded secret) combined with unsafe exposure of a command-execution primitive (AMI originate/System) via a web API. While Issabel PBX itself is not an AI agent framework, organizations that deploy voice/IVR agents, call-routing bots, or AI-driven contact-center automation on top of Issabel-based Asterisk infrastructure could see their agent hosts compromised, credentials and API keys on the box exfiltrated, and downstream agent tool-use pipelines hijacked via lateral movement from the compromised PBX host.

Affected Systems

Issabel Framework / Issabel PBX web framework (pbxapi component) prior to commit b97dbaf; any Issabel PBX installation exposing the pbxapi/index.php endpoint to the network, including default and unpatched builds using Asterisk as the backend telephony engine.

Indicators of Compromise

• Exploitation reported by Shadowserver Foundation starting 2026-09-09
• Anomalous requests to pbxapi/index.php with crafted Authorization: Bearer JWT headers
• Manager API 'originate' calls invoking the 'System' application parameter
• Unexpected shell command execution under the 'asterisk' user process tree
• (Specific hashes/IPs/domains not disclosed in source data; consult Shadowserver feeds for current IOC lists)

Remediation Steps

1. 1

   Apply the patch / upgrade

   Update Issabel Framework to a version containing commit b97dbaf or later, which removes the hard-coded JWT signing key and enforces per-installation secret generation.

2. 2

   Rotate JWT signing secrets

   Manually regenerate and randomize the JWT signing key on all existing Issabel deployments, even after patching, to invalidate any previously forged or leaked tokens.

3. 3

   Restrict network exposure

   Ensure pbxapi and the Asterisk Manager Interface (AMI) are not exposed to the public internet; restrict access via firewall rules, VPN, or network segmentation to trusted management hosts only.

4. 4

   Disable or restrict dangerous AMI applications

   Limit or disable the ability to invoke the 'System' application via the manager originate endpoint, or implement strict allow-lists for permitted AMI actions.

5. 5

   Monitor and hunt for compromise

   Review Asterisk and web server logs for anomalous API authentication and originate calls, and check for signs of unauthorized OS command execution as the asterisk user, especially since exploitation began before 2026-09-09.

6. 6

   Audit downstream integrations

   If AI voice agents, IVR bots, or automation pipelines integrate with the affected PBX, rotate any API keys or credentials stored on or accessible from the host and audit for lateral movement into agent infrastructure.