CVE-2026-44237: high-severity vulnerability in FreePBX security-reporting
FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 2.7%
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
FreePBX · security-reportingRelated CVEs — FreePBX security-reporting
In the same product, most dangerous first.
CVE-2026-28287HIGHFreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsEPSS 9.3%CVE-2026-28209HIGHFreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integrationEPSS 1.0%CVE-2026-26978HIGHFree PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.phpEPSS 0.9%CVE-2026-54674HIGHAuthenticated Command Injection in FreePBX UCP InterfaceEPSS 0.9%CVE-2026-75600HIGHFreePBX: Authenticated API generatedocs Host Command InjectionEPSS 0.8%CVE-2026-54675HIGHFreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang ModuleEPSS 0.7%