High 7.4Published Jul 16, 2026

CVE-2026-46513Frogman provides headless PBX control through MCP and HTTP API.

Updated under an hour ago (2026-10-19 09:10 UTC)

Does this affect you?

It lists no affected products yet. Add what you run and Signals checks it as products are added.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Exploited in the last 30 days

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.

CVSS: 7.4 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-256
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Deferred
Record last updated: Jul 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

No affected products are listed yet.

References

https://github.com/mwtcmi/frogman/commit/b10f314add08c8e7585ba4b27d071b07d026ab55
https://github.com/mwtcmi/frogman/releases/tag/v1.6.1
https://github.com/mwtcmi/frogman/releases/tag/v1.6.2
https://github.com/mwtcmi/frogman/security/advisories/GHSA-9xf5-9ghq-p6cw

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.