CVE-2025-66039

Published Dec 9, 2025

Last updated 11 days ago

FreePBX Endpoint Manager

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-66039 is an authentication bypass vulnerability affecting the FreePBX Endpoint Manager module when the authentication type is set to "webserver". By providing an arbitrary Authorization header, an attacker can create a session associated with a target user without needing valid credentials. This vulnerability allows an unauthenticated attacker to potentially gain unauthorized access to FreePBX Endpoint Manager systems. The issue is fixed in FreePBX Endpoint Manager versions 16.0.44 and 17.0.23.

Description: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
Source: security-advisories@github.com
NVD status: Analyzed
Products: freepbx

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-287

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "703A0A9A-676E-473F-A3B3-69E6316ACABF",
            "versionEndExcluding": "16.0.44"
          },
          {
            "criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D7313952-094B-4519-946E-3726B0E4C7AD",
            "versionEndExcluding": "17.0.23",
            "versionStartIncluding": "17.0.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.