CVE-2026-46513

Name of the Vulnerable Software and Affected Versions Frogman versions prior to 1.6.2

Description Frogman provides headless PBX control through MCP and HTTP API. The software stores API tokens generated by the CreateApiToken.php function as raw strings in the oc api tokens table. The Frogman.class.php function authenticates the X-Frogman-Token header by comparing it with these stored raw values. This allows an attacker with database read access to recover active tokens and gain unauthorized access at the assigned permission level, including administrative privileges.

Recommendations Update to version 1.6.2.