Reflected Cross-Site Scripting in Asterisk Telephony Toolkit
CVE-2026-57196
2.3LOW
What is CVE-2026-57196?
A vulnerability in the Asterisk Telephony Toolkit allows unauthenticated attackers to exploit reflected cross-site scripting in phone provisioning HTTP error pages. This can lead to the retrieval of an authorized user's Asterisk Manager Interface (AMI) session cookie, enabling impersonation of that user. For successful exploitation, an attacker must convince the authorized user to click a malicious link while having access to the enabled Asterisk HTTP server and AMI. The issue is addressed in recent software updates.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1