CVE-2025-66039

When FreePBX Endpoint Manager is configured with "webserver" authentication type, the identity verification mechanism does not validate the correctness of submitted credentials. An attacker only needs to append an Authorization header with any arbitrary value to an HTTP request — the system incorrectly associates the session with the target user, completely bypassing password verification. This is a classic CWE-287 (improper authentication) vulnerability resulting from the lack of actual validation of the authorization header value.

An unauthenticated remote attacker can gain unauthorized access to any FreePBX system user account, taking control of telephone device management (endpoints). This results in potential complete takeover of the telephone system configuration, data theft, and the ability to perform further actions in the infrastructure.

The FreePBX Endpoint Manager module should be updated to version 16.0.44 or later (16.x branch) or 17.0.23 or later (17.x branch). As an interim workaround, consider changing the authentication type from "webserver" to another available mode and restricting network access to the FreePBX management panel.

FreePBX Endpoint Manager — vulnerable versions are those prior to 16.0.44 (16.x branch) and 17.0.23 (17.x branch), when the authentication type is configured as "webserver"