CVE-2025-66039Critical· 9.8▾ AbyssalPoC availableFreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.3%
3.3% → 3.4%
2 GitHub repos · Metasploit ×3 (last check)
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
freepbx < 16.0.44freepbx >= 17.0.1, < 17.0.23Upgrade past the affected range:
freepbx 17.0.23Connected by shared product, vendor, weakness, or advisory.
CVE-2025-67722High· 7.8FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk
CVE-2025-67736High· 7.2The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk
CVE-2025-57819Critical· 9.8FreePBX is an open-source web-based graphical user interface
CVE-2025-59429Medium· 5.4FreePBX is an open source GUI for managing Asterisk
CVE-2026-75600High· 8.8FreePBX is an open source IP PBX
CVE-2026-54675High· 8.8FreePBX is an open source IP PBX