CVE-2026-46514

MEDIUM 6.5

Frogman: Plaintext passwords and secrets persisted to audit log

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.

CWE	CWE-532
Vendor	mwtcmi
Product	frogman
Published	Jul 16, 2026
Last Updated	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for mwtcmi frogman

Be the first to know when new medium vulnerabilities affecting mwtcmi frogman are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

mwtcmi / frogman

< 1.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mwtcmi/frogman/security/advisories/GHSA-3p65-2prr-cfvf github.com: https://github.com/mwtcmi/frogman/commit/02203edb613774f265ad8a21d99c4f6cf7de0d4d github.com: https://github.com/mwtcmi/frogman/releases/tag/v1.6.1 github.com: https://github.com/mwtcmi/frogman/releases/tag/v1.6.2