CVE-2025-66039criticalCWE-287

CVE-2025-66039: critical vulnerability in FreePBX framework

FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

Published · Updated

Follow this CVE+ Monitor framework

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 3.4%
from disclosure to weapon5 days
Published on NVDDec 9
1st PoC+5d
metasploit+2d
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
FreePBX · framework
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FreePBX framework

In the same product, most dangerous first.

CVE-2025-59056MEDIUMFreePBX vulnerable to unauthenticated Denial of ServiceEPSS 0.5%CVE-2025-55211MEDIUMFreePBX Post-Authenticated Command InjectionEPSS 0.4%CVE-2026-73661HIGHFreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted BackupEPSS 0.3%CVE-2025-67722MEDIUMAuthenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalationEPSS 0.1%