Frogman versions before 1.6.2 stored API tokens generated by Tools/CreateApiToken.php as raw bin2hex(random_bytes(32)) strings in the oc_api_tokens database table. Authentication in Frogman.class.php compared the X-Frogman-Token header directly to these stored raw values. Because tokens were stored in plaintext form, an attacker with database read access could retrieve reusable active tokens at their assigned permission levels, including admin tokens. This plaintext storage of sensitive authentication tokens constitutes a CWE-256 vulnerability. The issue is resolved in version 1.6.2.

An attacker who gains read access to the Frogman database prior to version 1.6.2 can recover active API tokens stored in plaintext. These tokens allow authentication at the permission level assigned, including administrative access, potentially leading to unauthorized control of the PBX system. The vulnerability does not affect availability but impacts confidentiality and integrity.

Upgrade Frogman to version 1.6.2 or later, where this vulnerability is fixed. Patch status is not explicitly stated beyond the fix in 1.6.2; therefore, applying this version upgrade is the recommended remediation. No vendor advisory is provided to indicate alternative mitigations or temporary fixes.