CVE-2025-66039 is an authentication bypass in the FreePBX framework when the authentication type is set to webserver. A forged Authorization header with any value gets a session for the target user. Fixed in framework 16.0.44 and 17.0.23. If you do not use webserver auth, you are not exposed.
What's affected
- Product: Sangoma FreePBX, framework module (named as Endpoint Manager in the record text).
- FreePBX 16: versions before 16.0.44. Fixed in 16.0.44.
- FreePBX 17: versions before 17.0.23. Fixed in 17.0.23.
- Condition: the Authorization Type setting must be webserver. The advisory says the webserver authtype dates from 2007 and assumes a separate, secure web server configuration.
Severity differs by source. The record scores it 9.8 (critical) under CVSS 3.1. The vendor advisory is rated Critical at CVSS 4.0 base 9.3, and then states a more complete score of 4.8 (medium) once its environmental and threat metrics are applied. Treat the base score as the worst case and the vendor view as a reminder that exposure depends on that one setting.
How to check if you're exposed
The advisory gives a CLI check. On the FreePBX host, run:
fwconsole setting --list | grep -i authtype
If the value is usermanager, this issue does not apply. If it is webserver, you may be at risk. In the GUI, the advisory has you set Display Readonly Settings to Yes under Settings, Advanced Settings, then read Authorization Type.
Also confirm the module version in the Module Admin page or with fwconsole ma list, and compare it with 16.0.44 or 17.0.23.
What to do now
- Check Authorization Type with the command above. If it is webserver and you did not choose that on purpose, treat the system as possibly compromised and review it.
- Upgrade the framework module to 16.0.44 (FreePBX 16) or 17.0.23 (FreePBX 17).
- Follow the vendor steps to change Authorization Type to usermanager, apply config, and reboot to drop any rogue sessions. The advisory warns to do this carefully.
- Firewall the admin interface so it is reachable only from management networks. The advisory says proper firewalling greatly reduces the effect of this issue.
- Note that the patch removes the GUI method of choosing webserver auth. New installs that want it must set it from the CLI.
Why it matters
The weakness is CWE-287, improper authentication. With webserver auth, FreePBX leaves the identity check to the web server in front of it. The advisory says that when an Authorization header carried an arbitrary value, a session was still associated with the target user, so the check that should have rejected bad credentials did not.
PBX admin panels are attractive because they control call routing, extensions and trunks. A takeover can mean toll fraud or call interception. The record does not list this as exploited in the wild and it is not on CISA KEV, but internet facing admin panels get probed quickly after disclosure, so patch and restrict access together.
Quick check
Am I affected if I use the default user manager login?
The advisory says the issue arises when Authorization Type is webserver. Systems on usermanager are described as unaffected, but upgrading is still the right move.
What if I find webserver enabled and I did not set it?
The advisory says to analyze the system fully for signs of compromise, not just to change the setting.
Sources
Last reviewed: 18 October 2026.
