VULNERABILITY INTELLIGENCE

CVE-2025-66039

CVSS score9.8 CRITICAL

EPSS probability3.39%

CISA KEVNot currently listed

Published2025-12-09

Last modified2026-09-25

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.

Weakness classification

security-advisories@github.com: CWE-287

Primary references

security-advisories@github.com — Product
security-advisories@github.com — Mitigation, Vendor Advisory
security-advisories@github.com — Not Applicable, Vendor Advisory