FreePBX Endpoint Manager
CVE-2025-66039
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FreePBX web interface
-
DeliveryCraft request with arbitrary Authorization header
-
ExploitBypass webserver auth, bind session to target user
-
ExecutionGain authenticated admin access to endpoint manager
-
ImpactManipulate telephony endpoints/config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the FreePBX Endpoint Manager authentication type to be configured to 'webserver' - this is the specific, non-default setting that enables the bypass; instances using the default database authentication are not affected. When that mode is set, no credentials are needed: an attacker simply supplies an Authorization header with any arbitrary value and the session is associated with the targeted user. Limiting factors are network reachability of the FreePBX web interface and the presence of the webserver auth configuration; there is no user-interaction or attacker-authentication requirement. Affected versions are those prior to 16.0.44 (16.x) and 17.0.23 (17.x). |
| Impact | This is a genuine high-priority issue when the affected configuration is present. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H = 9.3) describes a remote, network-reachable, unauthenticated authentication bypass yielding full impact, which the description supports: sending an Authorization header with any arbitrary value binds a session to a target user without valid credentials. The critical caveat is that this only applies when the Endpoint Manager authentication type is set to 'webserver' - a non-default deployment mode - so the raw 9.3 overstates blanket risk for the typical FreePBX install using database authentication. No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Signals are internally consistent (network unauth bypass), but the missing EPSS/KEV/POC means widespread active exploitation cannot be asserted; treat this as a must-patch for any FreePBX instance configured with webserver auth, and lower urgency for default-auth deployments. |
| Exploit ScenarioDerived | An attacker who can reach the FreePBX admin/Endpoint Manager web interface (Internet-exposed or LAN) sends an HTTP request including an Authorization header populated with any arbitrary value while targeting a chosen user account. On a system where the authentication type is set to 'webserver', the request is accepted and a valid session is bound to that user, granting administrative telephony control without credentials. No public exploit code is referenced in the provided data, but the technique is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Authentication bypass in the FreePBX Endpoint Manager module lets remote, unauthenticated attackers impersonate any targeted user - including administrators - by sending an Authorization header containing an arbitrary value, but only on installations where the module's authentication type is configured to "webserver." The flaw is a classic improper-authentication (CWE-287) defect: the code treats the mere presence of the header as proof of identity instead of validating credentials, so the resulting session is bound to the attacker-chosen account. Instances using the default database authentication mode are not affected; there is no user interaction or attacker credential requirement (CVSS 4.0 base 9.3, assessed 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis).
RemediationAI
Vendor-released patch: upgrade the FreePBX Endpoint Manager module to 16.0.44 (16.x branch) or 17.0.23 (17.x branch) as documented in the advisory GHSA-9jvh-mv6x-w698; these are the exact fixed versions, and no workaround restores the security guarantee of the patch. Because exploitation hinges on the non-default authentication mode, the most effective immediate compensating control is to switch the Endpoint Manager authentication type away from "webserver" back to the default database-based authentication - the trade-off is that any SSO or reverse-proxy/webserver-integrated login flow you built on that mode will stop working, and it must be re-validated after patching before being re-enabled. In parallel, restrict network reachability of the FreePBX web administration interface to trusted management networks or VPN clients and place it behind an authenticating reverse proxy or firewall allow-list, since the flaw requires only HTTP reachability plus the webserver auth setting; this reduces exposure but does not by itself eliminate the bypass, and locking the admin UI to internal networks can inconvenience legitimate remote administrators. Audit existing session and login logs for requests bearing unusual or arbitrary Authorization header values against Endpoint Manager endpoints to detect attempted or successful abuse prior to patching, and rotate credentials for any accounts that may have been impersonated. Do not treat the referenced framework commit as a substitute for installing the tagged 16.0.44 / 17.0.23 module releases.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Endpoint Manager module within Sangoma FreePBX, the web-based PBX administration framework that provisions and manages telephony endpoints (phones, gateways, softphones). FreePBX supports multiple authentication backends; the vulnerable path is the non-default "webserver" authentication type, in which the module is meant to delegate identity verification to the surrounding web server. Under CWE-287 (Improper Authentication), the module fails to actually verify that the supplied Authorization header corresponds to a valid, authenticated principal: any non-empty arbitrary value in that header causes the request to be associated with the target user's session, granting that user's privileges. The independent assessment confirms the prerequisite is configuration-specific - the "webserver" auth type must be enabled - and that the default database authentication mode is unaffected, which is why the assessed 3.1 vector uses AC:H even though PR:N/UI:N reflect the absence of credential or interaction requirements once the mode is set. The public reference set includes a commit to the FreePBX/framework repository (04224253156543cd9932b90458660b2f19fc0e35); the excerpted diff in that commit removes legacy AAH maintenance scripts rather than the authentication logic itself, so the precise code change should be confirmed against the vendor advisory GHSA-9jvh-mv6x-w698 before relying on the repository diff as the definitive fix.
Know when Freepbx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network unauthenticated bypass with full admin impact, but AC:H because it depends on the non-default 'webserver' authentication mode being configured.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
Executive ViewAI
FreePBX's Endpoint Manager module contains a critical authentication bypass that, when configured to use 'webserver' authentication, allows a remote unauthenticated attacker to impersonate any account-including administrators-and control telephony management functions. No public exploit has been identified at the time of analysis and no vendor-released patch has been identified at the time of analysis, so leadership should prioritize confirming whether the vulnerable authentication mode is enabled and reducing exposure of the FreePBX administrative interface. Affected organizations face potential unauthorized configuration changes, data exposure, and service disruption until mitigations or a vendor fix are applied.
Switch Endpoint Manager authentication type from 'webserver' to 'database' (default database mode is not affected); disable the Endpoint Manager module if unused; restrict FreePBX admin and Endpoint Manager access to trusted networks or VPN; ensure the web server enforces valid authentication before passing requests to Endpoint Manager; monitor web server and application logs for anomalous Authorization headers or unexpected admin sessions; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
FreePBX 15, 16, and 17 contain SQL injection vulnerabilities enabling unauthenticated access to the administrator interf
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attacke
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9,
Authenticated arbitrary file upload in the FreePBX Endpoint Manager module (FreePBX 16 before 16.0.92 and FreePBX 17 bef
Authenticated SQL injection in the FreePBX Endpoint Manager module allows a user holding a valid, known FreePBX username
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Rated
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access contr
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order param
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrar
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. Rated medium se
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unaut
Exploit-DB