CVE-2026-46513

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46513
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46513.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46513
Aliases
  • GHSA-9xf5-9ghq-p6cw
Published
2026-07-16T18:14:05Z
Modified
2026-08-12T03:51:49Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Frogman: API tokens stored in plaintext
Details

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-256"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46513.json"
}
References

Affected packages

Git / github.com/mwtcmi/frogman

Affected ranges

Type
GIT
Repo
https://github.com/mwtcmi/frogman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b10f314add08c8e7585ba4b27d071b07d026ab55
Fixed
cdbdbf371daa939731e330aace9f25140aa727fe
Fixed
2ca0c36caad11e2833d844a3e33fba2e414896cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46513.json"