Authentication Bypass in FreePBX Endpoint Manager by FreePBX
CVE-2025-66039

9.3CRITICAL

Key Information:

Vendor: Freepbx
Status: Security-reporting
Vendor: CVE Published:; 9 December 2025

Badges

📈 Trended📈 Score: 3,570👾 Exploit Exists🟣 EPSS 31%📰 News Worthy

What is CVE-2025-66039?

CVE-2025-66039 is a security vulnerability affecting the FreePBX Endpoint Manager, a module designed to facilitate the management of telephony endpoints in FreePBX systems. This vulnerability arises specifically when the authentication type is configured to "webserver." An attacker can exploit this flaw by providing an arbitrary value in the Authorization header, resulting in an authentication bypass where a session is wrongly associated with the targeted user, regardless of whether valid credentials are supplied. This unauthorized access could result in significant security risks for organizations relying on FreePBX for their communication needs, potentially leading to unauthorized changes to configuration settings, exposure of sensitive data, or manipulation of the telephony system.

Potential impact of CVE-2025-66039

Unauthorized Access: Attackers could gain unauthorized access to user sessions, allowing them to manipulate telephony settings and potentially reroute calls or intercept communications without proper authorization.
Data Exposure: The vulnerability could lead to the exposure of confidential information, including sensitive voice communications and configurations, which could be exploited for malicious purposes.
System Compromise: If an attacker exploits this flaw, they may be able to compromise the overall integrity of the FreePBX system, leading to further attack vectors within the organization’s IT infrastructure, posing risks beyond just telephony systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

security-reporting < 16.0.44 < 16.0.44

security-reporting >= 17.0.1, < 17.0.23 < 17.0.1, 17.0.23

News Articles

Cyber Press

CVE-2025-66039

FreePBX Vulnerabilities Enable Authentication Bypass Leading to Remote Code Execution

The vulnerabilities chain together via an authentication bypass that circumvents web server authentication controls, enabling SQL injection and arbitrary file upload.