EUVD-2026-33300Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Strong authentication
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Authentication bypass in FreePBX api module (versions prior to 17.0.8) allows OAuth2 access tokens to be issued without verifying the client_secret, because the ClientRepository validateClient() method unconditionally returns true. An attacker who knows or guesses a valid client_id can mint tokens granting API access to the PBX, leading to unauthorized read and write operations against telephony configuration. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Freepbx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.
Executive ViewAI
FreePBX versions prior to 17.0.8 contain an authentication bypass vulnerability in the API module that allows attackers with knowledge of a valid OAuth2 client_id to obtain API access without verifying their credentials, potentially exposing critical telephony infrastructure. This vulnerability threatens core communications systems including call routing, voicemail, and user permissions management. Organizations using affected versions should prioritize immediate mitigation.
Within 24 hours: Identify all FreePBX systems running versions prior to 17.0.8; document deployed OAuth2 client_ids and integrations; disable OAuth2 API access if operationally feasible. Within 7 days: Review API and PBX configuration change logs for suspicious activity; assess business criticality of affected systems; initiate testing of FreePBX 17.0.8 upgrade. Within 30 days: Complete upgrade to FreePBX 17.0.8 or later; rotate all OAuth2 client credentials post-upgrade; validate all API integrations in production.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable OAuth2 API module if not operationally required; (2) implement network-level firewall rules restricting access to the API endpoint; (3) apply IP whitelisting to OAuth2 token requests; (4) audit and remove unused OAuth2 client credentials; (5) enable comprehensive API access logging and configure alerts on token issuance events; (6) monitor PBX configuration change logs for unauthorized modifications; (7) implement rate-limiting on OAuth2 token endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
FreePBX 15, 16, and 17 contain SQL injection vulnerabilities enabling unauthenticated access to the administrator interf
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attacke
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9,
Authenticated arbitrary file upload in the FreePBX Endpoint Manager module (FreePBX 16 before 16.0.92 and FreePBX 17 bef
Authenticated SQL injection in the FreePBX Endpoint Manager module allows a user holding a valid, known FreePBX username
Authentication bypass in the FreePBX Endpoint Manager module lets remote, unauthenticated attackers impersonate any targ
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Rated
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access contr
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order param
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrar
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. Rated medium se
Exploit-DB