CVE-2026-46514: CWE-532: Insertion of Sensitive Information into Log File in mwtcmi frogman
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.
AI Analysis
Technical Summary
CVE-2026-46514 describes a CWE-532 vulnerability in mwtcmi frogman, a headless PBX control system. Before version 1.6.2, the fm_reset_password and fm_add_extension functions returned plaintext credentials which were logged in JSON format into oc_audit_log.detail via auditOutcome. Any user with PERM_READ permission and access to fm_audit_search could retrieve these sensitive credentials from the audit logs. This exposure of plaintext passwords and secrets in logs constitutes an information disclosure vulnerability. The issue is resolved in frogman version 1.6.2.
Potential Impact
The vulnerability allows users with read permissions on the audit logs to recover plaintext passwords and secrets, leading to potential unauthorized access or credential compromise. There is no indication of impact on integrity or availability. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and privileges required.
Mitigation Recommendations
This vulnerability is fixed in frogman version 1.6.2. Users should upgrade to version 1.6.2 or later to remediate the issue. No official vendor advisory or patch link is provided, but the version-based fix is confirmed. Until upgraded, restrict PERM_READ access to trusted users only to limit exposure.
CVE-2026-46514: CWE-532: Insertion of Sensitive Information into Log File in mwtcmi frogman
Description
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46514 describes a CWE-532 vulnerability in mwtcmi frogman, a headless PBX control system. Before version 1.6.2, the fm_reset_password and fm_add_extension functions returned plaintext credentials which were logged in JSON format into oc_audit_log.detail via auditOutcome. Any user with PERM_READ permission and access to fm_audit_search could retrieve these sensitive credentials from the audit logs. This exposure of plaintext passwords and secrets in logs constitutes an information disclosure vulnerability. The issue is resolved in frogman version 1.6.2.
Potential Impact
The vulnerability allows users with read permissions on the audit logs to recover plaintext passwords and secrets, leading to potential unauthorized access or credential compromise. There is no indication of impact on integrity or availability. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and privileges required.
Mitigation Recommendations
This vulnerability is fixed in frogman version 1.6.2. Users should upgrade to version 1.6.2 or later to remediate the issue. No official vendor advisory or patch link is provided, but the version-based fix is confirmed. Until upgraded, restrict PERM_READ access to trusted users only to limit exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-14T19:12:32.754Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59206068715ace437c3f07
Added to database: 07/16/2026, 18:18:08 UTC
Last enriched: 07/16/2026, 18:33:18 UTC
Last updated: 07/17/2026, 00:58:01 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.