CVE-2026-57196— Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

Quick assessment

Affected

asterisk asterisk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用交换机（PBX）和电话工具包。在以下版本之前：Asterisk 20.20.1、21.12.3、22.10.1、23.4.1，以及认证版 Asterisk 20.7-cert11 和 22.8-cert3，未经身份验证的攻击者若启用了模块，可利用“电话配置 HTTP 错误页面”中的反射型跨站脚本（XSS）漏洞，窃取已授权用户的 AMI（Asterisk Manager Interface，Asterisk 管理接口）会话 Cookie，从而冒充该用户。此漏洞的触发需要同时满足以下

CVSS 2.3 · Low Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1055.004 · Asynchronous Procedure Call T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

Source: CVE Program / CVE List V5

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in `phone provisioning HTTP error pages` to retrieve an authorized user's `AMI session cookie` and impersonate that user when `res_phoneprov` is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to `127.0.0.1` by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
asterisk	asterisk	< 20.20.1	-
asterisk	certified-asterisk	< 20.7-cert11	-

II. Public POCs for CVE-2026-57196

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57196

请登录查看更多情报信息。

Other References for CVE-2026-57196 (15)

https://github.com/asterisk/asterisk/tree/24.0.0-pre1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/23.4.1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/21.12.3 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/20.20.1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/22.10.1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 x_refsource_MISC
https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/60c23d8b56b2cf93caceb527e07654b16f388343 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/4373f8174bf71c467fc9db96036126d30425b9e8 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/4b360a61d649a7c12b1021aa554642322ee28c10 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/dc43c5b32a3a216da4c9e95388fbadaca3e78bc8 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/87399593cda601ae3670bf890bdb32f78e881bf3 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/9cff8e62fbd9e7db87c233de3335047df88877d0 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/e6998409f73f49959d0062c695bb9a2f611af5ac x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57196

Same Patch Batch · asterisk · 2026-10-26 · 4 CVEs total

CVE-2026-57187	7.1 HIGH	Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection close
CVE-2026-57193	6.9 MEDIUM	Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Infor
CVE-2026-57184	6.3 MEDIUM	Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)

IV. Related Vulnerabilities

Same product: asterisk

Same vendor: asterisk

Same weakness: CWE-79