Live › vulnerability › CVE-2026-57196
Go to dashboardA reflected cross-site scripting flaw in Asterisk's phone provisioning HTTP error pages lets an unauthenticated attacker make an authorized user's AMI session cookie reachable. With that cookie the attacker can impersonate the user in the Asterisk Manager Interface, but only after the user clicks a malicious link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Only systems that run Asterisk with res_phoneprov loaded, the HTTP server, AMI and AMI over HTTP all enabled are exposed. The HTTP server binds to 127.0.0.1 by default, so an attacker must be able to reach it, and a logged-in AMI user must be tricked into clicking a link. Teams running default configurations or without phone provisioning can skip it.
No product ranges from the sources yet.
asterisk -V and compare against the fixed releases.res_phoneprov is loaded with asterisk -rx "module show like phoneprov".http.conf and manager.conf; all three are disabled by default.20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk to 20.7-cert11 or 22.8-cert3.res_phoneprov or the Asterisk HTTP server.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an authorized user's AMI session cookie and impersonate that user when res_phoneprov is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57196")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.