API Token Authentication Vulnerability in Frogman by mwtcmi
CVE-2026-46513
7.4HIGH
What is CVE-2026-46513?
Frogman, a headless PBX control system, has a vulnerability due to improper handling of API tokens before version 1.6.2. The system generates API tokens as raw bin2hex representations of random bytes, which are stored in the database without adequate protection. An attacker can exploit this flaw by obtaining the X-Frogman-Token header and comparing it with the stored value, enabling unauthorized database read access. This access could allow recovery of active tokens with the permissions assigned to them, potentially granting admin-level privileges. The issue has been rectified in version 1.6.2.
Affected Version(s)
frogman < 1.6.2