Which versions of PHP are affected by CVE-2026-44237?

FreePBX versions prior to 17.0.8 contain an authentication bypass vulnerability in the API module that allows attackers with knowledge of a valid OAuth2 client_id to obtain API access without…. A patch is available.

How to fix or mitigate CVE-2026-44237?

Within 24 hours: Identify all FreePBX systems running versions prior to 17.0.8; document deployed OAuth2 client_ids and integrations; disable OAuth2 API access if operationally feasible. Within 7 days: Review API and PBX configuration change logs for suspicious activity; assess business criticality of affected systems; initiate testing of FreePBX 17.0.8 upgrade. Within 30 days: Complete upgrade to FreePBX 17.0.8 or later; rotate all OAuth2 client credentials post-upgrade; validate all API integrations in production.

PHP CVE-2026-44237

Q: What is the CVSS score of CVE-2026-44237?

CVE-2026-44237 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33300 HIGH

Weak Authentication (CWE-1390)

2026-05-29 GitHub_M

Information Disclosure PHP Security Reporting

7.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 15:01 EUVD

Analysis Generated

May 29, 2026 - 14:33 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

7.6 (HIGH)

DescriptionCVE.org

FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.

AnalysisAI

Authentication bypass in FreePBX api module (versions prior to 17.0.8) allows OAuth2 access tokens to be issued without verifying the client_secret, because the ClientRepository validateClient() method unconditionally returns true. An attacker who knows or guesses a valid client_id can mint tokens granting API access to the PBX, leading to unauthorized read and write operations against telephony configuration. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.