Which versions of PHP are affected by CVE-2026-44237?

FreePBX versions prior to 17.0.8 contain an authentication bypass vulnerability in the API module that allows attackers with knowledge of a valid OAuth2 client_id to obtain API access without…. A patch is available.

How to fix or mitigate CVE-2026-44237?

Within 24 hours: Identify all FreePBX systems running versions prior to 17.0.8; document deployed OAuth2 client_ids and integrations; disable OAuth2 API access if operationally feasible. Within 7 days: Review API and PBX configuration change logs for suspicious activity; assess business criticality of affected systems; initiate testing of FreePBX 17.0.8 upgrade. Within 30 days: Complete upgrade to FreePBX 17.0.8 or later; rotate all OAuth2 client credentials post-upgrade; validate all API integrations in production.

PHP CVE-2026-44237

Q: What is the CVSS score of CVE-2026-44237?

CVE-2026-44237 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33300 HIGH

Weak Authentication (CWE-1390)

2026-05-29 GitHub_M

PHP Information Disclosure

7.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 15:01 EUVD

Analysis Generated

May 29, 2026 - 14:33 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

7.6 (HIGH)

DescriptionGitHub Advisory

FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.

AnalysisAI

Authentication bypass in FreePBX api module (versions prior to 17.0.8) allows OAuth2 access tokens to be issued without verifying the client_secret, because the ClientRepository validateClient() method unconditionally returns true. An attacker who knows or guesses a valid client_id can mint tokens granting API access to the PBX, leading to unauthorized read and write operations against telephony configuration. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Identify all FreePBX systems running versions prior to 17.0.8; document deployed OAuth2 client_ids and integrations; disable OAuth2 API access if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.