I am writing to issue an urgent security warning regarding ASTPP Version 6.0 Community. During a recent review, a severe anomaly was detected in the platform’s user portal that could potentially lead to unauthorized data access and privilege escalation.
I am already in direct contact with the development team regarding this issue so they can investigate the root cause and implement a fix.
While this is being addressed by the maintainers, I strongly suggest that all administrators temporarily disable the creation of new user accounts (/signup/) as a strict precautionary measure.
Furthermore, I highly recommend reviewing your access logs immediately for any unusual activity, sudden spikes in traffic, or unexpected requests originating from unknown IPs.
Hi, thanks for the heads up, based on your description we probaly found the issue and provided a fix for our own installation. Has the development team already reacted?
Beside that, we found some other (critical) issues aswell, will report them shortly.
The problem is, if I share it public, it will be known and all not patched versions can be infiltrated, same for the existing one above (which is indeed a nasty one).
Also, write them in public forum isnt the way for a proper disclosure. I’ll wait for the feedback of @alaurent , if they’ve already responded, will write them our own findings and give two weeks for a reaction.
This is why projects have to update their frameworks. The CodeIgniter framework is a more than a decade old. 15 years. It shouldn’t even be advertised.
Honestly, most issues are’nt even related to codeigniter - but indeed, replace codeigniter is a must have. My fork runs currently on debian 13 and php8.5, but codeigniter still needs to be replaced, which is indeed a massive work due to the changes on the framework itself.
You are right that CodeIgniter needs to be replaced. It is a significant undertaking because of how much the framework has changed, as you noted, but it is the correct direction and it is on our mind. For now our priority is addressing the specific issues raised here and getting the fixes into the repo.
We have reviewed the code of ASTPP 6.0 Community Edition (branch V6.0, commit d5108ec, which is still the latest version) and reported our findings to iNextrix on 10.10.2026.
In total we reported 41 security issues:
Severity
Count
Critical
7
High
12
Medium
14
Low / operational
8
Several of the critical issues can be exploited without authentication. In addition, we reported 6 functional defects in rating and package handling.
The signup issue reported in this post by @alaurent is one of the findings. The credit for it goes to him.
Until fixes are available, we recommend restricting access to the web interface and the SIP ports to known IP addresses where possible, and keeping admin access to as few people as possible.
Hi @ScITGmbH, thanks for the follow-up. I completely agree with your approach; keeping the exact technical details private right now is the only responsible way to protect all the unpatched systems out there.
Just to keep the community and the developers on the same page: I sent the full, detailed technical report—including the exact exploit methodology—directly to Samir Doshi’s email on October 6th.
I haven’t received a direct reply or official acknowledgment to that email yet. However, seeing @smrdoshi’s comment above, I assume the development team has received my report and is actively working on integrating the fix into the repository.
I will continue to hold off on publishing any further specifics to give the team the necessary time to release an official patch for the Community Edition. I’ll be waiting for an update from the dev team.
Thank you very much for raising these important security concerns.
We are also closely following this discussion, as we are currently working with ASTPP 6.0 Community Edition and planning to go into production soon.
The reported 41 security issues are quite concerning, and it would be extremely helpful to have the necessary fixes implemented before we go live.
A big thank you to @ScITGmbH and @alaurent for reporting these issues, and to @smrdoshi for working towards implementing the fixes as soon as possible!
This is a follow-up to our earlier post about the issues we reported to iNextrix.
While extending and hardening our installation, we found further issues and reported them to the vendor on 10.10.2026.
Severity
New
Total reported
Critical
0
7
High
2
14
Medium
1
15
Low / operational
0
8
Security issues
3
44
As before, we will not publish technical details before the coordinated disclosure date of 7 January 2027, so that the vendor can release fixes first.
What you should do now
If you installed the optional API add-on (“OPEN APIs”), please uninstall it or at least block the paths /api/ and /admin/ in your web server for everyone except trusted IP addresses. The add-on is not active unless it was installed through the add-on management. If you never installed it, this part does not affect you.
For all installations:
Do not rely on passwords and PINs generated by ASTPP. Set your own strong, random passwords for portal accounts and SIP devices.
Keep the public self-signup disabled unless you need it.
If possible, restrict access to the web interface and the SIP ports to known IP addresses, as recommended in our earlier post.
We will post an update when the vendor publishes fixes or when the disclosure date is reached.
This is a second follow-up to our earlier posts about the issues we reported to iNextrix.
Since the last update we have systematically tested the authorization of all web endpoints with every role (administrator, reseller, customer, provider) and reviewed the money flows and the dialplan. We reported the results to the vendor on 11.10.2026. They affect ASTPP 6.0 Community Edition, branch V6.0, commit d5108ec, which is still the latest version.
Severity
New
Total reported
Critical
0
7
High
5
19
Medium
3
18
Low / operational
3
11
Security issues
11
55
In addition, we reported 7 more functional defects (14 in total).
As before, we will not publish technical details before the coordinated disclosure date of 7 January 2027, so that the vendor can release fixes first.
What you should do now
If resellers or customers can log in to your ASTPP web interface, treat that access as a risk until fixes are available:
Give portal access only to resellers and customers you fully trust. Where possible, restrict access to the web interface to known IP addresses, as recommended in our earlier posts.
Review recent changes to accounts, SIP devices, DIDs, products and invoices for anything you did not expect, and keep regular database backups.
Payments: do not enable PayPal as a payment method until the vendor has published a fix.
Resellers: do not rely on an expiry date to stop the traffic of a reseller’s customers - deactivate the reseller account instead.
For all installations, the advice from our earlier posts still applies: strong, self-chosen passwords (not the ones generated by ASTPP), public self-signup disabled unless needed, and access to the web interface and the SIP ports restricted where possible.
We will post an update when the vendor publishes fixes or when the disclosure date is reached.
Confirming receipt of your detailed report. Apologies for the delay in direct acknowledgment on email.
Thanks also to @ScITGmbH for sharing the patches with us. Our team will integrate them into the codebase (Along with some other patches), run our internal validation, and then release the patched build to the Community Edition for broader testing. We are targeting approximately 2 weeks for the patched release and will post an update in this thread once it is available.
Appreciate the responsible disclosure approach from both of you. It genuinely helps protect the wider ASTPP user base, and we want to encourage more of this.
@ScITGmbH@alaurent do you conduct these kinds of audit on any open source VoIP solutions? I use ASTPP in front of a different open source VoIP solution and I’m sure that community would appreciate these kinds of audit. How can I privately reach out?
Hi @airsay
No, we’re not an “official” security company, we just reviewed ASTPP as we want to use it for our infrastructure and found the already reported issues. Beside that, we built our own fork of astpp which includes some upgrades (php8.5) and other optimization things - according to the GNU AGPL v3 license, we will make our fork public as soon as the reported issues has been fixed and a release published.