CVE-2026-46514mediumCWE-532

CVE-2026-46514: falha de média gravidade em mwtcmi frogman

Frogman: Plaintext passwords and secrets persisted to audit log

Publicada em

Seguir esta CVE+ Monitorar frogman

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
mwtcmi · frogman
CVEs relacionadas — mwtcmi frogman

No mesmo produto, das mais perigosas para as menos.

CVE-2026-46512CRITICALFrogman: Dialplan template parameters interpolated into extensions_custom.conf without escapingEPSS 0.7%CVE-2026-46515CRITICALFrogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL executionEPSS 0.6%CVE-2026-46516MEDIUMFrogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)EPSS 0.4%CVE-2026-46513HIGHFrogman: API tokens stored in plaintextEPSS 0.4%