🔐 CVE Alert

CVE-2026-57196

UNKNOWN 0.0

Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in `phone provisioning HTTP error pages` to retrieve an authorized user's `AMI session cookie` and impersonate that user when `res_phoneprov` is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to `127.0.0.1` by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CWE CWE-79
Vendor asterisk
Product asterisk
Published Oct 26, 2026
Last Updated Oct 26, 2026
Stay Ahead of the Next One

Get instant alerts for asterisk asterisk

Be the first to know when new unknown vulnerabilities affecting asterisk asterisk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

asterisk / asterisk
< 20.20.1 >= 21.0.0-pre1, < 21.12.3 >= 22.0.0-pre1, < 22.10.1 >= 23.0.0-pre1, < 23.4.1
asterisk / certified-asterisk
< 20.7-cert11 >= 22.8-cert1-pre1, < 22.8-cert3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp github.com: https://github.com/asterisk/asterisk/commit/4373f8174bf71c467fc9db96036126d30425b9e8 github.com: https://github.com/asterisk/asterisk/commit/4b360a61d649a7c12b1021aa554642322ee28c10 github.com: https://github.com/asterisk/asterisk/commit/60c23d8b56b2cf93caceb527e07654b16f388343 github.com: https://github.com/asterisk/asterisk/commit/87399593cda601ae3670bf890bdb32f78e881bf3 github.com: https://github.com/asterisk/asterisk/commit/9cff8e62fbd9e7db87c233de3335047df88877d0 github.com: https://github.com/asterisk/asterisk/commit/dc43c5b32a3a216da4c9e95388fbadaca3e78bc8 github.com: https://github.com/asterisk/asterisk/commit/e6998409f73f49959d0062c695bb9a2f611af5ac github.com: https://github.com/asterisk/asterisk/releases/tag/20.20.1 github.com: https://github.com/asterisk/asterisk/releases/tag/21.12.3 github.com: https://github.com/asterisk/asterisk/releases/tag/22.10.1 github.com: https://github.com/asterisk/asterisk/releases/tag/23.4.1 github.com: https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 github.com: https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 github.com: https://github.com/asterisk/asterisk/tree/24.0.0-pre1