Critical severity · published Dec 9, 2025
CVE-2025-66039
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
9.8
CVSS
3.4%
EPSS
No
On KEV
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
framework · FreePBX
< 16.0.44; >= 17.0.1, < 17.0.23 · source: vendor
FR
Freepbx · Sangoma
before 16.0.44; 17.0.1 before 17.0.23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66039
Product
https://github.com/FreePBX/framework/commit/04224253156543cd9932b90458660b2f19fc0e35#diff-72f14a52840a61504a8e03cd195035b44e488aecd634b001bc6412a04bdc940bR20-R50
Mitigation
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9jvh-mv6x-w698
Not Applicable
https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80
More from framework
8.8
CVE-2025-55211
FreePBX Post-Authenticated Command Injection
7.8
CVE-2025-67722
Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
7.5
CVE-2025-59056
FreePBX vulnerable to unauthenticated Denial of Service
6.5
CVE-2026-73661
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup