CVE-2026-46513

HIGH 7.4

Frogman: API tokens stored in plaintext

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.

CWE	CWE-256
Vendor	mwtcmi
Product	frogman
Published	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for mwtcmi frogman

Be the first to know when new high vulnerabilities affecting mwtcmi frogman are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

mwtcmi / frogman

< 1.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mwtcmi/frogman/security/advisories/GHSA-9xf5-9ghq-p6cw github.com: https://github.com/mwtcmi/frogman/commit/b10f314add08c8e7585ba4b27d071b07d026ab55 github.com: https://github.com/mwtcmi/frogman/releases/tag/v1.6.1 github.com: https://github.com/mwtcmi/frogman/releases/tag/v1.6.2