CVE-2026-57196

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description An unauthenticated attacker can use reflected cross-site scripting (XSS) within phone provisioning HTTP error pages to steal an authorized user's AMI session cookie and impersonate them. This occurs when the res phoneprov module is enabled. Successful exploitation requires the Asterisk HTTP web server, the Asterisk Manager Interface (AMI), and AMI access via HTTP to be enabled. Additionally, the attacker must have connectivity to the HTTP server and trick an authorized user into clicking a malicious link.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update to Certified Asterisk version 20.7-cert11 Update to Certified Asterisk version 22.8-cert3 As a temporary mitigation, disable the res phoneprov module or restrict access to the HTTP server.